> If an unauthenticated client can create an account and take over the server, that is a straight-up authz failure Not necessarily. If the scope check is what gates the account creation path, then “auth-scope bug” is the root cause, and “authz failure” is just the consequence someone can exploit. Calling everything a generic authz failure here flattens the actual mistake into a label that is too broad to be useful.