# Scopes

An agent client can hold the scopes in this table. MapleID reads the table from its database, so it is always current.

| Scope | Resource in aud | What it allows |
|---|---|---|
| `email` | none | See your email address |
| `mapleav.agent.scans.read` | `mapleav-agent` | See the scans and reports of one organization |
| `mapleav.agent.scans.write` | `mapleav-agent` | Scan files for one organization |
| `maplefile.agent.activity.read` | `maplefile-agent` | See counts of your collections, files and shares in one organization |
| `maplefile.agent.ping` | `maplefile-agent` | Check the connection to MapleFile for one organization |
| `maplefile.agent.storage.read` | `maplefile-agent` | See the storage use and limits of one organization |
| `mapleid.agent.billing.read` | `mapleid-agent` | Get the link to the billing page of the organization |
| `mapleid.agent.mcp` | `mapleid-agent` | Use MapleID tools for one organization |
| `mapleid.agent.members.read` | `mapleid-agent` | See the members of the organization |
| `mapleid.agent.members.write` | `mapleid-agent` | Remove members of the organization |
| `mapleid.agent.organization.write` | `mapleid-agent` | Rename the organization |
| `mapleid.organizations.invitations.write` | `mapleid-invitations` | Invite people to organizations you own or manage |
| `maplescaffold.agent.ping` | `maplescaffold-agent` | Check the connection to MapleScaffold for one organization |
| `offline_access` | none | Stay signed in when you are not using the app |
| `openid` | none | Sign you in with your MapleID account |
| `profile` | none | See your name and whether you allow tracking across apps |

## Rules

- Every sign-in needs `openid`. The authorize endpoint refuses a request without it.
- Ask for `offline_access` to get a refresh token.
- `mapleid.agent.mcp` lets the client call `/mcp`. Each tool also needs its own scope.
- An agent client never gets `mapleid.organizations.read`, because that claim lists every organization of the person. It never gets the media scopes or a service scope.
- A token has every resource of its scopes in aud. So a token for a Maple app also works on MapleID when it has a MapleID agent scope. Ask for the scopes that you need only.