GCP Professional Cloud Architect Practice Question

Google's recommended practice is to ask for the minimum scope necessary when it is needed. The app should therefore request only the openid or profile scope during the initial sign-in, then trigger an incremental authorization request for the more sensitive drive.file scope when the user explicitly chooses the Export action. This minimizes the number of permissions shown on the first consent screen and typically results in higher approval rates.

Requesting broad scopes such as drive.* or cloud-platform up front violates the principle of least privilege and can lower consent acceptance. Embedding an unrestricted API key on the client side removes user consent entirely and exposes the key to theft. Using a backend service account with domain-wide delegation allows access without user interaction but is intended for managed domains and still does not align with requesting scopes incrementally as the user's workflow requires.