---
title: Scopes and permission filtering
description: Understand the two authorization gates applied to every request.
---

A token scope is a coarse gate. The resolved user must also pass the same permission rules used by the staff application. Scopes can narrow access; they never widen that user's access.

The current reference documents read scopes for matters, relations, documents, hours, tasks, billing, and BI, plus write scopes for matters, relations, hours, and tasks. A missing scope returns `403`. Resource permissions are applied before serialization, so list totals include only visible rows.

[Open the published OpenAPI JSON](/openapi.json) to see the required scope for each operation, or read the [developer API map](/developers/public-api).