Lesson 3: Scopes, rules and real identity providers
22 min read·13 Oct 2026
Module 7 · Lesson 3 · About 50 minutes · Needs: Lessons 1 and 2 of this module (token verifier, 401 and discovery, the authorization flow); Module 2 Lesson 3 (Streamable HTTP in a notebook)
The situation
Monday 28 September 2026, week 4. Lessons 1 and 2 put a token check on the HTTP notes server. Priya and Tomas now connect from their own computers, and any valid token still opens every tool. Course-guide/03's rule: Nare holds notes:read and notes:write; Priya and Tomas hold notes:read. Today the server enforces it per tool, asks for more only when needed, refuses to forward tokens, and meets real identity providers. The running example is one call, create_note("Sleep lab checklist"), made with each person's token.