What are your thoughts on allowing multiple instances, each with its own OAuth endpoint and its own scope, the same pattern Maker API uses?
One issue is that the current access-control axes don't line up. selectedDevices (plus the bypass toggle) scopes device operations only, and diagnostics, logs, File Manager, backups, hub_get_source etc. ride on the Read/Write masters alone. So "write access to these three devices" isn't really expressible today. Any token that can write to three devices can also read the Groovy source of every app on the hub, read the File Manager, and reach the backup tools.