What does an app receive when you grant limited access?
An app may need permission to read a calendar without receiving permission to change it. OAuth separates that delegated access from simply handing over an account password. Tokens and their allowed scope help express the grant, while validity and expiration affect whether a particular request can proceed.
Questions you could explore
- Why does permission to read not automatically imply permission to write?
Start reading
- RFC Editor / IETFRFC 6749: The OAuth 2.0 Authorization Framework
The OAuth 2.0 framework defines the roles, access tokens, and scope of delegated authorization.
- RFC Editor / IETFRFC 9700: Best Current Practice for OAuth 2.0 Security
The later security guidance explains restricting privileges. It is context for the concept, not a complete implementation recipe.
Ready to try your ideas aloud?
Your topic carries over. Record up to 2½ minutes, depending on your plan.