Scopes

API keys are least-privilege and default-deny. Scopes are read/write per area:

Scope	Grants
`employees:read`	Read minimized employee records.
`employees:read:pii`	Additionally expose salaries / personnummer.
`surveys:read` / `surveys:write`	Read / manage survey campaigns.
`settings:read` / `settings:write`	Read / manage org settings.
`users:read` / `users:write`	Read / manage user accounts.
`roles:read` / `roles:write`	Read / manage custom roles.
`analytics:read`	Read computed pay-gap results.

employees:read strips salary and personnummer; those are gated behind the separate employees:read:pii scope.