The consent screen appears. One endpoint, one token, but the stakes change with every parameter you send. This is Oauth 2.0 query-level approval — precision control over what an access token can do, decided at runtime.
Oauth 2.0 was built for delegation at scale. Standard scopes define broad permissions, but they rarely fit the exact shape of modern API calls. Query-level approval narrows the scope to match the request itself. This means the resource server checks not just the access token, but the query, path, or method the client is trying to execute, before letting it through.
To implement query-level approval, the authorization server must be able to evaluate query parameters during the consent and token issue process. This requires defining fine-grained scopes, tied directly to API actions and query constraints. When a client requests access, the server presents the user with granular consent options — not "read all data," but "read data for customer ID 42" or "update only order status."
Security improves because the token can only authorize exactly what was approved. Even if leaked, it is useless outside its permitted query space. The resource server enforces this by validating both the token’s claims and the incoming query against allowed values.