AgentsSeptember 2, 2026via InfoQ AI/ML
Cloudflare Adds Optional OAuth Scopes, Letting Developers Mark What Users May Decline
Why it matters
As agents become the default way to integrate with APIs, permission systems built for human users break down. Cloudflare is fixing a concrete friction point that will matter as agent deployments scale.
Key signals
- Cloudflare added optional OAuth scopes feature
- Developers can now mark which permissions users may deselect
- MCP (Model Context Protocol) servers cited as primary motivating use case
- Agents request union of all possible permissions they might need
- Solves consent friction where agents need broad access but users want granular control
- Developer control over optional scopes is novel (partial consent exists elsewhere)
- Developers can now mark which permissions users may decline
- Addresses agent pattern of requesting union of all possible actions
- Developer control over droppable scopes is novel vs. existing partial-consent systems
- Published September 2, 2026
The hook
Cloudflare's optional OAuth scopes solve a real agent problem: MCP servers request permission for everything they might do. Now developers can let users refuse some.
Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the union of everything they might do. Partial consent exists elsewhere, but developer control over which…