OAuth scopes control access at a granular level. They tell an application which parts of a user’s profile, account, or stored data it can touch. Managing these scopes well is not optional when handling personally identifiable information. PII data includes names, emails, phone numbers, addresses, ID numbers—anything that ties directly to a person. Leaks or misuse can trigger legal action, compliance failures, and lasting damage to trust.
Poor scope management leads to over-permissioned tokens. This means apps get more access than they need. When PII is involved, overexposure is a security failure. Limit scopes to the minimum set required for the task. Use strict definitions so that a scope meant for "basic profile" never includes an email or phone number unless required. Audit scopes regularly to track changes and uncover permissions creep.
Tie scope definitions directly to internal data classification. If a database field contains PII, gate it behind its own explicit scope. Avoid broad scopes like read:all for mixed datasets. Instead, split sensitive fields into targeted scopes (read:email, read:phone). This reduces blast radius in case of token compromise.