Least-privilege API scopes limit what breached bots can do. Learn scope design that grants function while withholding danger.