The alert fired at 03:17. One service was down, three others were degraded, and the root cause was an expired OAuth scope that no one had tracked.
OAuth scopes define what access a token grants. Without clear scope management, systems pile up unused permissions, tokens with excessive power, and brittle chains of trust. For Site Reliability Engineering teams, unmanaged scopes are ticking failures — they cause outages, security incidents, and compliance gaps.
Effective OAuth scopes management starts with inventory. Map every service, client, and token. List their scopes. Delete unused ones. Restrict broad scopes to cases that cannot function without them. Every scope should have purpose, owner, and expiration. Automate this check. Static lists rot fast.
Enforce least privilege at the scope level. If a microservice only reads a resource, give it only read scopes. If a user-facing app doesn’t need admin rights, block them in the token request. Narrow scopes make lateral movement harder for an attacker and limit blast radius when credentials are exposed.