Proper Scopes for CMI5

[theZaX]

I've been working on integrating CMI5 courses with learninglocker, I have it working with a broadly scoped token returned from the fetch endpoint that essentailly gives clients access to everything in the LRS.

This obviously wouldn't work for production, my current plan is to generate a token that is scoped to the user. On the documentation https://docs.learninglocker.net/http-clients/ it appears to have "statements/read/mine" "statements/write" as the way to scope it to a user. Then it has a broad "state" and "profile".

If what I am thinking is correct the only way to let the CMI5 course update the state for its own lesson is to give it access to state for the entire LRS? Also is the only way to give the course access to write statements giving access to read all statements for that user as well?