Cloudflare's permission reference distinguishes account, zone, and user scopes. A Cloudflare API client should select the resource boundary alongside the permitted operation.
Test access to the intended zone and rejection from an unintended one. A token that validates successfully may still lack, or exceed, the authority the workflow needs.
Akousa