Credential scope is the set of permissions attached to a token, API key, service account, or login. It defines what the credential can read, write, execute, or reach, and where those actions are allowed. A narrow scope might permit only one repository or one API method; a broad scope may expose many systems.
In cyber security, credential scope matters because stolen or misused credentials can only do damage within their permissions, unless the scope is too wide. Attackers look for over-scoped tokens to move laterally, download private data, or change code and configuration. Defenders reduce risk with least privilege, short-lived credentials, scoped API tokens, separate test and production accounts, and strict outbound controls. In AI testing, a sandbox can still touch live services if the harness uses credentials with more scope than intended, so logging and scope review are essential.