Scopes are the real boundary on anything running unattended. A client without products:write cannot touch the catalog, however it is prompted.

An agent can discover its own capabilities at start-up rather than learning them from a 403:

pxb whoami --json | jq -r '.content.token.scopes[]'

Asking for something outside them fails clearly:

403 GET products
Access token is missing required scope(s): products:read

Grant narrowly — a browser sign-in starts from nothing, per company, and an API client from the scopes you tick — and give each agent its own, so you can revoke one without disturbing the rest. Every endpoint page in the API reference lists the scope it requires.