Scopes

A scope is a name a credential may carry. The kernel checks it, never the caller — every surface (API, CLI, MCP, SDK) reaches the same gate, so a scope withheld is withheld everywhere at once.

Scopes are also the vocabulary an app asks for consent in, which is why this list holds names that no command carries: an app can request a power a role can then refuse.

The floor

These reads answer every authenticated operator, with no scope at all. No role can exclude them.

read.internal.whoami

Decided per request

One read name can serve many shapes — an app’s own table, for instance, where each app declares in its manifest what lives in it. For these, the requirement is a function of the read’s own parameters rather than a fixed name, so it is not listed under any single scope above.

read.internal.extension_records

`admin.users.write`

Commands — admin_user.disable · admin_user.enable · admin_user.invite · iam.api_key.create · iam.api_key.revoke · iam.api_key.rotate · operator.access_key.create · operator.access_key.revoke

Reads — read.internal.admin_users · read.internal.api_keys · read.internal.operator_access_keys

`audit.read`

Reads — read.internal.audit · read.internal.promotion_activity

`catalog.admin.read`

Reads — read.internal.brands_admin · read.internal.catalog_labels · read.internal.categories_admin · read.internal.collection_admin · read.internal.collections_admin · read.internal.product · read.internal.product_media · read.internal.product_sku_dimensions · read.internal.product_sku_media · read.internal.product_stores

`catalog.category.write`

Commands — catalog.category.create · catalog.category.move · catalog.category.set_custom_fields · catalog.category.update

`catalog.product.publish`

Commands — catalog.product.publish · catalog.product.publish_bulk · catalog.product.unpublish · catalog.product.unpublish_bulk

`catalog.product.write`

Commands — catalog.brand.archive · catalog.brand.create · catalog.brand.update · catalog.collection.archive · catalog.collection.create · catalog.collection.pin · catalog.collection.reorder · catalog.collection.unarchive · catalog.collection.unpin · catalog.collection.update · catalog.media.attach · catalog.media.detach · catalog.media.reorder · catalog.media.update · catalog.option.create · catalog.option.delete · catalog.option.update · catalog.option_value.create · catalog.option_value.update · catalog.product.archive · catalog.product.categorize · catalog.product.create · catalog.product.uncategorize · catalog.product.update

`catalog.read`

Carried by no command and gating no read — a consent symbol an app manifest may ask for.

`catalog.sku.write`

Commands — catalog.sku.create · catalog.sku.delete · catalog.sku.update

`composition.write`

Commands — composition.move · composition.place · composition.placement.remove · composition.placement.reorder · composition.placement.set · composition.remove · composition.reorder · composition.toggle · composition.update_config

`content.read`

Reads — read.internal.assets · read.internal.pages

`content.write`

Commands — content.page.archive · content.page.create · content.page.update

`custom_fields.write`

Commands — custom_field.archive · custom_field.define · custom_field.update

`customer.admin.write`

Commands — customer.anonymize · customer.set_custom_fields · customer_cluster.archive · customer_cluster.create · customer_cluster.pin · customer_cluster.unarchive · customer_cluster.unpin · customer_cluster.update

Reads — read.internal.cluster_admin · read.internal.clusters_admin · read.internal.customer · read.internal.customers

`customer.self.read`

Carried by no command and gating no read — a consent symbol an app manifest may ask for.

`customer.self.write`

Commands — customer.address.create · customer.address.delete · customer.address.update · customer.link_cart · order.request_cancellation

`extensions.egress.consent`

Commands — extension.connection.set

`extensions.read`

Reads — read.internal.available_extensions · read.internal.extension_composition · read.internal.extension_config · read.internal.extension_health · read.internal.installed_extensions · read.internal.instance_extensions · read.internal.payment_methods_admin

`extensions.write`

Commands — extension.config.set · extension.install · extension.uninstall · notification.channel.register

`iam.roles.write`

Commands — admin_user.set_role · role.archive · role.create · role.update

Reads — read.internal.roles

`inventory.adjust`

Commands — inventory.adjust · inventory.set_level · warehouse.create · warehouse.update

`inventory.reserve`

Commands — inventory.commit · inventory.reclaim_expired · inventory.release · inventory.reserve

`logistics.read`

Reads — read.internal.carriers · read.internal.pickup_location · read.internal.pickup_locations · read.internal.routing_suggestion · read.internal.shipping_methods_admin · read.internal.shipping_rates · read.internal.shipping_simulation · read.internal.shipping_zones · read.internal.stock_addable_skus · read.internal.stock_levels · read.internal.warehouses

`media.write`

Commands — asset.archive · asset.create · media.request_upload

`notification.send`

Commands — notification.send

`operator.otp.request`

Commands — operator.request_otp

`operator.self.write`

Commands — admin_user.set_locale

`operator.session.mint`

Commands — operator.mint_oidc_session · operator.verify_otp

`order.payment.write`

Commands — order.payment.record

`order.read`

Reads — read.internal.notification (any of order.read · order.write) · read.internal.notifications (any of order.read · order.write) · read.internal.order_admin (any of order.read · order.write) · read.internal.orders_admin (any of order.read · order.write) · read.internal.sales_metrics (any of order.read · order.write) · read.internal.shipment_queue (any of order.read · order.write)