The concept of OAuth Scopes is even more silly when looked at through layman's eyes. If your experience with average humans is, that they will be able to make a

The concept of OAuth Scopes is even more silly when looked at through layman's eyes. If your experience with average humans is, that they will be able to make a judgement calls about wether an app they want to use can reasonably require access to a specific scope, you are not actually dealing with average humans. Average humans will be at best insecure or indifferent in light of these choices as presented, but certainly not informed. I do think any system asking for these kinds of decisions should at least communication very clearly a recommendation about how to proceed and provide the necessary tools to judge if "permanently delete all calendars" is a reasonable request. This could maybe be solved with a more thorough (maybe AI automated) review process and JIT OAuth requests (or more frictionless update requests) only when necessary in the app process. I understand that it's simpler to pawn this off to the user in a roundabout way, but we need to be better and more compassionate with actual users.