What does the OAuth 2.0 'scope' parameter control, and why is 'minimal scope' important?

• A.Scope defines the specific permissions being requested; requesting minimal scope (only what's needed) limits damage if the token is stolen or the application is compromised - a token scoped to 'read:calendar' cannot send emails
• B.Scope defines the lifetime of the token (a longer scope means a longer expiry); requesting minimal scope (only the shortest value) reduces token size on the wire - a token scoped to 'read:calendar' is smaller than one scoped to 'write:email'
• C.Scope selects the signing algorithm (a larger scope uses RS256); minimal scope keeps tokens small only for mobile networks - a token scoped to 'read:calendar' is signed with HS256
• D.Scope names the user's roles in the directory (admin or editor); minimal scope hides roles from the API only when the token is opaque - a token scoped to 'read:calendar' contains no role claims