Is this a valid statement about the creation of a PAT?

No. Current Identity Security Cloud behavior does not automatically assign sp:scopes:all when an administrator or user creates a Personal Access Token without explicitly selecting scopes. SailPoint documents that when no scopes are selected, the default scope is assigned. That default provides permission only for API endpoints that do not require authorization; it is not equivalent to unrestricted access under sp:scopes:all.

The sp:scopes:all scope must be intentionally selected when required. Even then, it does not grant arbitrary privileges beyond the token owner's authority. Instead, it authorizes API scopes that are available through the user levels assigned to the user who created the PAT. Consequently, PAT permissions remain bounded by that identity's effective Identity Security Cloud privileges.

This behavior supports the principle of least privilege. SailPoint recommends selecting only the scopes necessary for the application or integration using the token rather than broadly assigning sp:scopes:all.

Therefore, leaving all scope checkboxes unselected does not implicitly grant all available API scopes.

Study Guide Reference: Platform — Personal Access Tokens, OAuth/API Scopes, sp:scopes:all and Least-Privilege API Authentication.

===============