Scopes
OAuth permission scopes for controlling agent access.
Axiom uses OAuth2 scopes to control what an AI agent can do. When you connect an agent, the consent screen describes what it will be able to do in three plain sentences. Each sentence stands for a group of scopes, and it appears when any scope in its group is requested. The agent requests and receives the same scopes either way; only the wording changes.
Available Scopes
| Scope | Consent line | Description |
|---|---|---|
payments:write | Place orders for you, within the limits you set | Place orders and answer questions about them |
mandates:write | Place orders for you, within the limits you set | Reserved (see below) |
rules:read | Place orders for you, within the limits you set | Reserved (see below) |
payments:read | Check how each order is going and share your receipts | Reserved (see below) |
transactions:read | Check how each order is going and share your receipts | Check an order's status and list recent orders |
transactions:write | Check how each order is going and share your receipts | Reserved (see below) |
account:read | See your name and which card is on file (last 4 digits only) | View the card on file (brand and last 4 digits) and whether account setup is complete |
A client that requests only read scopes sees the second and third lines and no "place orders" line.
Scope Details
account:read
Grants access to:
- The card on file, brand and last 4 digits only, and whether account setup is complete (
get_payment_method)
payments:write
The core scope for agent spending. Grants access to:
- Place an order (
place_order) - Answer a question about an order and continue it (
answer_order_question)
When an agent calls place_order, Axiom validates the intent mandate, evaluates the user's spending rules, runs the checkout server-side, issues a single-use virtual card, and charges the payment method on file.
transactions:read
Grants access to:
- Check where an order stands, with its approval link, question, or receipt (
get_order_status) - List recent orders (
list_orders)
Reserved scopes
rules:read, payments:read, transactions:write, and mandates:write are defined and are covered by the consent lines above, but no currently published MCP tool requires them: spending rules are evaluated server-side on every order, receipts are attached automatically, and intent mandates are created by Axiom during place_order. They're reserved for upcoming tools; allowing them today enables nothing beyond the tools listed above.
Principle of Least Privilege
Grant agents only the scopes they need. An agent that only checks account info should receive just account:read; it doesn't need payments:write. Ordering requires payments:write (to place orders and answer questions); checking on orders requires transactions:read.