Scopes
OAuth permission scopes for controlling agent access.
Axiom uses OAuth2 scopes to control what operations an AI agent can perform. When authorizing an agent, you select which scopes to grant.
Available Scopes
| Scope | Consent label | Description |
|---|---|---|
account:read | Account Access | View the linked payment method (brand and last 4 digits) |
payments:read | Payment Details | Poll the status of an in-progress purchase |
payments:write | Make Purchases | Start purchases and submit clarifications |
transactions:read | View Transactions | View transaction history and details |
rules:read | View Rules | Reserved (see below) |
transactions:write | Update Transactions | Reserved (see below) |
mandates:write | Authorize Purchases | Reserved (see below) |
Scope Details
account:read
Grants access to:
- The linked payment method, card brand and last 4 digits only (
get_payment_method)
payments:read
Grants access to:
- Poll an in-progress purchase for status, progress, approval links, and the final receipt (
get_purchase_status)
payments:write
The core scope for agent spending. Grants access to:
- Start a server-managed browser checkout (
make_purchase) - Answer a clarification and resume a parked purchase (
submit_purchase_clarification)
When an agent calls make_purchase, Axiom validates the intent mandate, evaluates the user's spending rules, runs the checkout server-side, issues a single-use virtual card, and charges the user's linked payment method.
transactions:read
Grants access to:
- List recent transactions (
list_transactions) - Fetch a single transaction with its receipt and audit trail (
get_transaction)
Reserved scopes
rules:read, transactions:write, and mandates:write are defined and may appear on the consent screen, but no currently published MCP tool requires them: spending rules are evaluated server-side on every purchase, receipts are attached automatically, and intent mandates are created by Axiom during make_purchase. They're reserved for upcoming tools; granting them today enables nothing beyond the tools listed above.
Principle of Least Privilege
Grant agents only the scopes they need. An agent that only checks account info should receive just account:read; it doesn't need payments:write. Running purchases requires payments:write (to start) and payments:read (to poll).