Four working scopes: ask (full agent turns), read (memory search, entities, catalogs), write (add facts and entities, forget), and tools (invoke tools, trigger agent runs). Default grant is ask plus read.
Scopes are enforced per endpoint, and a 403 names the missing scope so the fix is obvious. Tokens bound to a person additionally respect that person's data permissions on everything they read.
The deliberate default: out of the box a token can ask and read, and cannot touch anything side-effecting until an admin widens it.