Access Token
Coarse scopes do not establish access to every object. Richer grants can specify targets and actions, while current resource-state conditions still need appropriate checks.
-
-
API Management and Service Delivery
A gateway can validate credentials and enforce shared policies. Services still need authorization tied to their data and current business state.