When you connect a tool to another service, the consent screen listing what the app can do is listing its requested scopes. Scopes are the vocabulary of least privilege: a well-behaved integration asks only for what it needs, and a security-conscious buyer reads the list the way they would read a lease.
The practical distinctions for a business owner are read versus write, and broad versus narrow. Read scopes let software understand your data (see messages, view invoices); write scopes let it change reality (send messages, create invoices, issue refunds). A tool that requests write scopes on day one is asking for trust it has not earned; the safer pattern is read-only connection first, with write actions gated behind explicit human approval even after write access exists.
Two habits worth having: check which scopes each connected app actually holds (Google, Microsoft, and QuickBooks all expose this in their security settings), and revoke scopes when you stop using a tool; departed software should not keep keys. When a vendor documents exactly which scopes it requests per integration and why, that documentation is itself a trust signal.
See the term in practice
Connect your tools read only and watch the approval queue prepare real actions from your own context. Nothing sends until you approve it.