overbroad roles + permissions is such a problem on every platform. github surprisingly bad given their technical sophistication overall on my long-term wishlis

overbroad roles + permissions is such a problem on every platform. github surprisingly bad given their technical sophistication overall on my long-term wishlist: a standard way to aspirationally reduce your permissions footprint like if I'm a twitter plugin, and I need one operation for which there is only a broad permission, I request the broad permission ('read and write everything'), but include an optional manifest making it clear that I only need the one action ('add followers') this 1) enables a linter ecosystem to verify my footprint is narrower than it seems, and 2) over time lets the platform tailor offer narrower perms based on observed use-cases permissions matter bc users can audit them more easily than code