Each time an identity is passed downstream, the scope defined during token exchange should restrict rather than expand permissions, following the principle of least privilege.