Exam Slack-Dev-201 Topic 1 Question 47 Discussion

Slack explicitly recommends applying the principle of least privilege when choosing OAuth scopes. An application should request only the minimum permissions required to perform its intended functionality.
Every unnecessary scope expands the data or operations available to the application and therefore increases the potential impact of credential compromise, implementation defects, or inappropriate application behavior.
Slack's security guidance recommends defining minimal scope sets and auditing requested permissions regularly. Marketplace guidance reinforces the same principle because users and administrators may reject applications that request excessive access to sensitive Slack data. Slack does not charge applications according to their number of scopes, and narrower scopes do not exist primarily to improve performance.
Broad scopes have not simply been universally deprecated; rather, developers are expected to justify and minimize permissions. Therefore, B accurately captures Slack's security model and recommended application- design practice.