I am worried this may be too broad. For example, a HealthCare organization may be oaky with allowing a reputed Medication CDS vendor placing med orders, but not updating conditions on the patient. Also, despite this wording, the example shows a scope of messaging/ui.launchActivity

Existing Wording:

Authorization is at the level of message groups (e.g., messaging/ui) rather than specific messages (e.g., launchActivity).