CLI
Scopes
What bounds an agent, and how to check at runtime.
Scopes are the real boundary on anything running unattended. A client
without products:write cannot touch the catalogue, however it is prompted.
An agent can discover its own capabilities at start-up rather than learning them from a 403:
pxb whoami --json | jq -r '.content.token.scopes[]'
Asking for something outside them fails clearly:
403 GET products
Access token is missing required scope(s): products:read
Grant narrowly, and give each agent its own API client so you can revoke one without disturbing the rest. Every endpoint page in the API reference lists the scope it requires.
In your terminal: pxb help scopes