Fine-grained tokens are access tokens that grant only a narrow set of permissions, such as access to one repository, one API, or a specific workflow. Unlike broad secrets that can reach many systems at once, they are designed around least privilege: if the token is stolen, the attacker gets less usable access.
They matter because token leakage is a common way for intruders to move from a small foothold into production systems. In AI platforms and cloud services, a stolen token may let an attacker read data, trigger jobs, or call internal services. Defenders use fine-grained tokens to limit blast radius, simplify rotation, and contain incidents faster. They work best when combined with short lifetimes, rotation, and strict scope review.