Named groups of permissions that an OAuth app or personal access token (classic) can request to access both public and non-public data.