CustomScopeModifications

Per-object subtractions from the parent scope. Keys are API object names (the scope_priv model vocabulary, e.g. phonenumber, nsconfig, route); values: none (object removed entirely), ro (read/list/count only), update-only (read plus update - never create or delete), no-delete (everything except delete). An object not named inherits full parent access.

{
    "nsconfig": "none",
    "route": "ro",
    "device": "no-delete",
    "phonenumber": "update-only"
}