Why:
- points:read and points:write are named in ADR-0009 but were absent from
DEFAULT_SCOPES, so a provisioned key could not reach the read paths that
follow. The runbook documented only files:write and domains:write, which
understated what a default key can now do.
Changes:
- Add points:read and points:write to DEFAULT_SCOPES.
- Document the full scope table in the runbook, calling out that points:read
grants the text of every chunk of every file -- so an upload-only key gets
files:write alone.
Impact:
- Keys issued before this change keep their existing scopes; provisioning does
not backfill. Reissue or widen an existing key explicitly.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Ali Zarinkolah
5251990444