Scope

Read orders, read customers, change stock: each is a scope. When you connect an app to your store you hand it a list of them, and that list is the whole of what it can do. Nothing outside it is reachable, however the code is written and however badly a session goes.

That's the most reassuring fact in this work. An app without a scope to change orders leaves your orders alone; grant it one on purpose, and it can.

So grant the fewest you need and widen later if you have to. A read scope can look and nothing else. Adding one that writes is a decision, not a detail to wave through.