Minimize agent OAuth scopes from requested actions, data fields, user role, expiry, and risk tolerance