Live demo
2,400 observed tasks in. 8 out.
Nine scopes granted to a support agent across three task types. Watch it work out which two each task actually needs, and how long it had to watch before that was safe to act on.
Blast radius removed
80.1%
Tasks safe to tighten
3 of 3
Granted risk weight
156
Minimal risk weight
31
| Task | Observed | Scopes used | Over-grant | Unseen-scope risk |
|---|---|---|---|---|
| answer-question | 1,400 | orders:read, tickets:read | 10.4x | 0.0% |
| process-refund | 620 | orders:read, orders:refund, tickets:read | 4.0x | 0.0% |
| update-address | 380 | customers:read, customers:write, tickets:read | 4.0x | 0.0% |
The last column is the one that matters. Removing a scope is only safe when the chance that some rare task needs an unseen scope has fallen to zero — and after 2,400 observations, it has. Before that, this report is a suggestion rather than an instruction.