# Scopes and permissions

Forge apps declare the scopes they need, and Atlassian enforces them. The app can only do what its scopes allow, and a scope it does not have is not a scope it can use.

Scopes are about capability. Access to any individual page is still decided by Confluence permissions, per user, every time.

---

## When this matters

* Security reviews asking why an app requests a given scope.
* Understanding the difference between app capability and user access.
* Approving an app upgrade that changes scopes.

---

## The detail

| **Thing**      | **What happens**                                                      |
| -------------- | --------------------------------------------------------------------- |
| Read content   | Reading pages and attachments, so diagrams can be found and rendered. |
| Write content  | Storing diagram source, previews and macro configuration.             |
| Attachments    | Diagram source and preview images are attachments.                    |
| Custom content | Where diagram source and templates are stored.                        |
| User identity  | Knowing who is acting, for permissions and audit.                     |

---

## A few things that catch people out

* Scopes are the app's maximum capability, not any individual user's access.
* A user only ever sees what Confluence lets them see, regardless of app scopes.
* Upgrades that add a scope require an administrator to approve them, which is deliberate friction.

---

## Related

[AI and your diagram dataWhat is sent, when, and how to stop it.](https://help.gocapable.com/diagrams/ai-and-your-diagram-data.html)

[Hosting and data residencyWhere the services run.](https://help.gocapable.com/diagrams/hosting-and-data-residency.html)

[ExamplesWorking diagrams you can copy.](https://help.gocapable.com/diagrams/examples.html)

---

_Ask us the awkward questions. They have answers._