It's not clear to me how that helps, but you're probably right it does. But I feel like some things have gotten access to a token via a web-auth procedure such

It's not clear to me how that helps, but you're probably right it does. But I feel like some things have gotten access to a token via a web-auth procedure such that they have access to anything my account does, across organizations. I swear I have seen flows that ask me to give them that, and don't let me even limit to certain organizations. But I may be misunderstanding, for sure. The real problem is that i just don't understand github's auth model for third-party api access. So I have trouble understanding what the possiblities are, what permissions I"m granting, and if they were the minimum permissions the app could have asked for or not. Every time I go through it, it seems to be different than the time before.