Scopes and least privilege

Seven scopes, granted per credential.

Scope	What it allows
audit:read	Read audit events — the SIEM pull endpoint
risk:read	Read risk findings
policy:read	Read your policy configuration
policy:write	Change your policy configuration
users:read	Read admins and developers
users:write	Invite, approve and offboard people
gateway:invoke	Send AI requests through the Gateway

Choosing

Grant the minimum. Three patterns cover almost everything:

• A SIEM integration — audit:read only.
• A compliance or reporting script — audit:read, risk:read, policy:read.
• Provisioning automation — users:read, users:write.

policy:write deserves particular care: a credential holding it can turn your enforcement off. If something needs it, restrict that credential by IP as well.

IP restrictions

The allowlist and denylist are cheap and effective. A credential that only ever calls from your SIEM's egress address should say so — a leaked credential is then also useless.

gateway:invoke

This is what a tool needs to send AI requests through the Gateway. The Endpoint Suite manages this for developers automatically; you only need it explicitly for something you are building yourself.