Changing an app's requested OAuth scopes is a configuration step

Changing an app's requested OAuth scopes is a configuration step, not proof that an already installed token has lost a permission. For a no-write rollout, first disable the sender in deployed code, then reinstall or rotate the app authorization and verify the effective scopes before claiming the credential is read-only. A configuration page showing a narrower reinstall URL establishes intent; it does not by itself establish what an existing token can still do.

Applies when: reducing permissions on an installed Slack app or similar OAuth integration. Keywords: Slack OAuth scope removal reinstall token permission read only verification