---
title: "Grant narrow scopes · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/api-security/token-scopes
updated: 2026-10-20
licence: "All rights reserved"
---

# Grant narrow scopes

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [API security](https://agentwranglers.se/playbook/api-design/api-security)
- Rule: Give each token only the scopes its job needs, and check the scope on every endpoint.
- How: Define scopes per resource and action, such as `orders:read` and `orders:write`. Declare the scope each operation needs in the contract. Answer 403 with a problem naming the missing scope, and with `WWW-Authenticate: Bearer error="insufficient_scope"` as RFC 6750 defines.
- Check: Call `POST /orders` with an `orders:read` token. The answer is 403 and names `orders:write`.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/token-scopes`.

- Previous: [Authenticate with tokens in headers](https://agentwranglers.se/playbook/api-design/api-security/token-auth)
- Next: [Authorise every object](https://agentwranglers.se/playbook/api-design/api-security/object-authorisation)
- [API security](https://agentwranglers.se/playbook/api-design/api-security)