That's better than the current state of things, but I think still not as fine-grained as it should be, at least not without a lot of work and standardization. A

That's better than the current state of things, but I think still not as fine-grained as it should be, at least not without a lot of work and standardization. Among other things: - This requires that any time you want to be able to selectively grant a subset of your account's authority, it requires standardizing new scopes to do so if there aren't already some that are suitable - If I'm not mistaken, only the application is able to define which OIDC scopes are requested, and if the application requests more access than you'd like to give it, your options are limited - If I'm not mistaken, OIDC scopes can only be requested at authentication-time, so there's no way to grant additional access later on at runtime To be clear, none of this is specific to Matrix; most webapps seem to work this way! I just happen to be of the opinion that most webapps have way more access than they need. :)