AdminScope

What a route does to the pipeline, which is what decides the scope it demands.

Two, not one per route. The split that matters is between looking and acting: GET /admin/dlq/records returns event payloads, which is a disclosure; POST /admin/consumer:restart?target=latest permanently skips unconsumed events, which is destruction. An on-call engineer who only needs to read the DLQ during triage should not carry a credential that can also empty the pipeline, and that is the only distinction a token can usefully carry.

A token holding the write scope also satisfies Read. The mutating routes already return the state the read routes return — :restart answers with the full consumer status, :replay with the record identities it acted on — so refusing the GET while permitting the POST would be a distinction with no security content and one that produces an inexplicable 403 in the middle of an incident.