A server grants one full-access scope to every client, and auditors reviewing tokens cannot tell whether a user meant to read files or delete them. Which change makes the audit trail meaningful?
Select an answer to reveal the explanation.
Short Explanation
If everybody's badge opens every door, the badge log can't tell you who meant to visit the vault. Give out separate keys for reading, writing and deleting, and only when someone actually needs them. Then each grant tells a story about intent.
Full Explanation
The scope minimization guidance lists audit noise among the risks of poor scope design: a single omnibus scope masks user intent per operation. Its mitigation is a progressive least-privilege model in which a minimal baseline scope covers low-risk discovery and read operations and privileged operations require specific scopes requested through targeted step-up challenges; servers then log each elevation with the scopes requested and granted and a correlation ID. With fine-grained scopes, a token carrying a delete scope shows the user approved deletion, and the log records when that grant happened. Tool annotations are hints supplied by the server, untrusted unless the server is trusted, and they describe the tool's behavior rather than anything the user intended. Adding the user's email to tool arguments relies on client-supplied identity that can be forged and puts personal data where the model and logs can see it; identity should come from the verified token. Shortening token lifetime limits damage from leaks but leaves each token just as ambiguous about intent. Exam caveat: wildcard or omnibus scopes such as full-access or star are listed among the common mistakes of scope design. Operational check: review the scope catalog for any scope that grants both read and destructive operations, then confirm a destructive tool triggers a step-up challenge for its own scope.