A custom scope, or with include-built-in=yes a built-in catalog entry. A custom scope takes a built-in parent scope and removes rights from it, so it can never do more than its parent. Users and API keys are assigned it by name. Its rights come from these settings: