Working with Location Grants

OAuth application approval
          ∩
merchant-approved scope
          ∩
explicit location grants
          ↓
effective resource authority

Never treat a location_id in input as authority. List the locations visible to the credential, let the user select among those IDs, and persist only opaque public IDs.

Future merchant locations are not granted automatically. When a merchant changes authority, complete reauthorization. Narrowing grants immediately filters collections, invalidates bound cursors, and suppresses stale-authority webhook deliveries.