Scope:
| "fs:read"
| "fs:write"
| "model:read"
| "model:write"
| "model:upload"
| "geometry:read"
| "query:run"
| "gis:read"
| "gis:write"
| "checks:read"
| "checks:run"
| "checks:write"
| "actions:read"
| "actions:write"
| "collab:read"
| "collab:write"
| "workspaces:read"
| "workspaces:write"
| "ai:use"
| "bsdd:read"
| "bsdd:sync"
| "tokens:issue"
| "account:read"
| "account:write"
| "admin:read"
| "admin:write"
| "superadmin"
| "*"
Authorization scopes (docs/api-authorization-scopes-design.md §4.3) — the closed catalog, matching the server enum.