Permissions

Every permission rated against the permission-level model. Each rating shows which factors were assigned, what each contributed, and why — so you can disagree with a specific input rather than with the number.

Low 5 · Medium 4 · High 1 · Critical 1 · 11 rated

This dataset is a seed, not coverage

Microsoft Graph exposes well over a thousand permissions. These 11 exist to exercise the model end to end and to make its calibration visible. A permission that is not listed here is unrated, not low-risk — implementations must report it as unrated. See OQ-5.

Permission	Type	Score	Tier
Application.ReadWrite.All	application	81.2	Critical
RoleManagement.ReadWrite.Directory	application	64.6	High
Sites.FullControl.All	application	43.3	Medium
Directory.Read.All	application	37.3	Medium
User.Read.All	application	37.3	Medium
Files.ReadWrite.All	application	36.8	Medium
Mail.Send	delegated	28	Low
Mail.Read	delegated	14.1	Low
Mail.Read.Shared	delegated, RSC	12.1	Low
offline_access	delegated	10.2	Low
User.Read	delegated	7	Low

How a score is reached

Raw factor scores are grouped by risk domain, normalized against the domain’s maximum, weighted by the domain’s share, and summed into a 0–100 composite — the full method is in §4.

Domain	Weight	Maximum raw
Identity & Privilege Escalation	40%	140
Access Surface & Blast Radius	30%	165
Data Sensitivity & Leakage	25%	120
Compliance & Trust Heuristics	5%	40

Calibration is an open question

The scores below come from the method stated in §4.1. That method compresses real permissions toward the low end of the scale, and it disagrees with the worked examples in §6 by a full tier. This is the working group’s top open question — see OQ-1.

Using this data

curl -O https://citadel.ms/oars-permissions.json

The dataset and the model are published as versioned JSON on every release. Model · Permissions · Combinations