Glossary
Scoped Permission
A scoped permission names exactly what it covers: this operation, on this target, under these conditions — not 'access to the system' in general. The scope is what makes least privilege operational rather than aspirational: a principal can hold many scoped permissions, each narrow, and the sum of them still adds up to less exposure than one broad grant would.
Scoping has a real cost in complexity — more permissions to define, issue, and eventually retire — which is why systems under time pressure often reach for a broader grant instead. The tradeoff is worth naming explicitly rather than defaulting into it: broad grants are cheaper today and more expensive the day something goes wrong with the identity holding them.