Scopes & permissions
Scopes narrow what an embedded session can do — default-closed, least-privilege, enforced on every service.
The vocabulary
Scopes are coarse, one per CRM feature area, aligned to the view names and your plan features:
| scope | grants |
|---|---|
leads | Leads |
contacts | Contacts & accounts |
pipeline | Opportunities & forecast |
inbox | Activity inbox |
activity | Activity timeline |
reports | Reports & dashboards |
campaigns | Marketing campaigns |
automations | Workflows & sequences |
agent | Embedded ARIA |
* | Everything the tenant's tier allows |
Default-closed enforcement
Every embed-facing service checks the token's scopes. A call whose route is not covered returns 403 embed_scope_denied. Scopes only ever narrow access — they never grant anything above the tenant's plan tier, which is enforced independently (plan_features). So an embed is always ⊆ the tenant's own permissions.
A minted token's scopes must be a subset of the app's declared
enabledScopes, which must be a subset of this vocabulary. Requesting an unknown or undeclared scope is rejected at mint time.Toggle a scope off in the playground and re-mint — the gated surface (and the ARIA launcher) disappears immediately.