One deliberately narrow scope: start and read chats. No access to connected apps, memories, schedules, settings, or other accounts.
Tokens are stored as SHA-256 hashes, rotate aggressively, and die instantly on revocation from the Drift app.