Changing scopes after authorization

Scopes are chosen at approval and capped by organization policy at token issuance. An approval saves only the scopes the approver’s role allows, which are the ones the consent page lists; after a promotion to admin, the next authorization shows the consent page again before any admin scope is granted, and a demotion takes admin operations away on the next call. There is no post-grant scope mutation API (scopes_update or similar), because widening scopes without reconsent would bypass that trust boundary. To authorize a different set, run OAuth again and approve the desired scopes; this creates an independent connection. To replace the previous connection, revoke it on the console Home (/en-US/app). Browser logout does not revoke it.