These are very broad authorizations. In practice, each app using a form of launchActivity has an allowlist of which activities. The messaging is perhaps even more important. Note that CDS hooks suggestions rely upon standard SMART scopes for authorization. Could Web Messaging require both messaging/scratchpad and user/MedRequest.write to authorize an app to suggest a MedRequest via messaging?

Existing Wording:

Authorization is at the level of message groups