Finding / paperclip
2026-10-13-paperclip-beta-records-oauth-scope-provenance-instead-of-treating-requests-as-provider-proof
Beta records OAuth scope provenance instead of treating requests as provider proof. OAuth grant metadata distinguishes provider-reported scopes from requested_fallback and retains a per-grant requested baseline. Unrequested scopes come from provider evidence, while a refresh omitting scope retains earlier evidence rather than erasing an over-grant warning. This changes evidence records, not provider authorization; it does not introspect every token or backfill all historical grants.
Channel: preview-or-beta (2026.1012.1-beta.0). Half: both. Date: 2026-10-12.
Operator consequence: When reviewing preview grants, inspect scopeSource as well as the scope list. An empty extra-scope list with requested_fallback means unproved, not verified least privilege. Combine this with fresh reduced Google consent in section 14 rather than treating a request string as token authority.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-paperclip-beta-records-oauth-scope-provenance-instead-of-treating-requests-as-provider-proof
Source links
Primary links, including exact changelog lines when available.