Read-only scope is a permission setting that lets a user, service, or AI agent view or retrieve data without modifying it. In practice, the account can query records, fetch pages, and inspect configuration, but it cannot create, delete, or change anything. This is a basic but important control in cyber security because it limits the damage an automated tool can cause if it behaves unexpectedly.
In attacks, read-only access can still be abused for reconnaissance, such as enumerating endpoints, collecting sensitive metadata, or mapping defenses. In defenses, it is used to contain agents and other automation so a failed request does not turn into unauthorized changes. For browser-based AI systems, read-only scope helps separate safe retrieval from risky action, reducing the chance that fallback logic or excessive agency becomes a security problem.