OpenAPI 3.x SecurityRequirements with least-privilege scopes and token expiry documentation
Goal is to document least-privilege authentication using components.securitySchemes and per-operation security requirements in OpenAPI 3.x, with explicit permission boundaries per endpoint. OpenAPI describes mechanisms such as OAuth2, HTTP bearer and API keys and allows minimal scopes to be listed per operation, but the specification is documentation only. I