SE5 ★ — full_access is an ORDINARY scope at the engine boundary. A key granted full_access is
allowed for full_access but the engine does NOT implicitly grant an unrelated scope the key has no
rule for. The god-mode bypass ("if full_access is allowed, permit everything") is implemented in the
RESOLVER (ResolverBase.CheckAPIKeyScopeAuthorization), NOT the engine — so at the engine layer a
full_access grant confers exactly full_access. Pinning this keeps the bypass a single, auditable
resolver seam and prevents it from silently migrating into the engine.
SE5 ★ —
full_accessis an ORDINARY scope at the engine boundary. A key grantedfull_accessis allowed forfull_accessbut the engine does NOT implicitly grant an unrelated scope the key has no rule for. The god-mode bypass ("if full_access is allowed, permit everything") is implemented in the RESOLVER (ResolverBase.CheckAPIKeyScopeAuthorization), NOT the engine — so at the engine layer a full_access grant confers exactlyfull_access. Pinning this keeps the bypass a single, auditable resolver seam and prevents it from silently migrating into the engine.