Should a token grant access to anything more specific than the specified resource?

(copying from the wiki)

Would a token grant access to anything more specific than the provided resource, or would it be only for that specific resource? (e.g. should a token for https://example.com/alice/ also work on https://example.com/alice/feed)

• Giving meaning to the URLs like this is convenient but may be misleading or break security boundaries in unexpected ways.
• An alternative would be to include another parameter, such as the previously discussed "realm", or somehow using scopes for this.
• Following RFC8707: Resource Indicators for OAuth 2.0 this would mean allowing resource=https://example.com/alice/ to be used to retrieve the value of https://example.com/alice/feed
  • This allows the use of multiple resource parameters for the purpose of multiple resource URLs to provide access to

Start with the IndieAuth Specification and the RFC8707 Section 2 link cited in issue #83. Determine whether a token for https://example.com/alice/ grants access to https://example.com/alice/feed or only the exact resource, including the security implications and multiple resource parameters. Done means the specification states the resolved resource-matching rule.