Premiere Pro and Adobe IMS integration: can OAuth scopes be narrowed, and what happens when the refresh token expires mid-session?

We are integrating a workflow that relies on Adobe Premiere Pro's access to Creative Cloud services through Adobe Identity Management (IMS) OAuth 2.0. Our security review requires least-privilege authentication, but our understanding is that the scopes requested (such as creativecloud and asset) are fixed by the application's registered integration rather than configurable per user or per workflow.

The second concern is credential lifetime. Access tokens appear to expire after roughly an hour, with silent renewal via a stored refresh token. For long editing or rendering sessions, it is unclear what the user-visible behavior is if the refresh token has been revoked or has itself expired — whether Premiere Pro fails the in-progress operation, queues it, or blocks until re-authentication completes.

Assume a recent Premiere Pro release on a managed desktop environment; exact IMS behavior should be verified against current Adobe documentation and Desktop Service logs.

Specific questions:

1. Is there any supported way for an administrator to restrict Premiere Pro to a narrower OAuth scope set than the registered defaults?
2. When a refresh token is revoked mid-session, does Premiere Pro surface a re-authentication prompt immediately, or only when the next service call fails?
3. Can an in-progress render or asset sync survive the re-authentication interruption without data loss?