Some OAuth providers (like Google or Facebook) only grant limited privileges to the third party apps, and they state so clearly on the authorization page. For example, they say that an app can see who you are and your friend list, but not post on the wall. And so on.
Not all providers do it, though. With some of them, once a user authorizes the app and the provider issues the token, apparently you can do anything. The consumer can just keep the token and do whatever it likes as that user - for years (as is the case with JIRA) unless explicitly revoked by the user.
Is this correct? How do you deal with this craziness, if an API allows 3rd party apps to fully impersonate you without boundaries?
Relevant piece of docs from Atlassian (for the JIRA example): https://confluence.atlassian.com/display/APPLINKS/Configuring+authentication+for+an+application+link
request determines the level of access to use based on the access permissions of that pre-configured user
this to me says that data / services are accessible based on the auth settings of the user.