Say your agent needs to send an email with an attachment to someone outside the company.
Scopes answer whether it can send email at all, as that user. They can't answer whether that user should be sending this attachment to an external domain. That takes a policy check before
00:00
