You are configuring the scopes your app requires before submitting to the App Directory.

Slack's current Marketplace review policy explicitly requires applications to request only scopes associated with functionality that reviewers can currently test. Developers should not request access for speculative or future features. Because the feature requiring files:read does not yet exist, the application should omit that scope from the present submission. Once the feature has been implemented and can be demonstrated to Slack reviewers, the developer should update the requested OAuth permissions and submit the modified application for review again. That makes C correct. Option B is incorrect because adding a materially new scope to a published Marketplace application cannot simply bypass review. Slack reviews both application functionality and the permissions required to implement it. Options A and D violate least privilege by requesting access before any production feature requires it. This is particularly important for files:read, which Slack currently classifies among scopes that can provide substantial access to workspace data and may therefore trigger enhanced review. The older term App Directory in the source question corresponds to today's Slack Marketplace. This belongs to Distribute Your App, with a strong relationship to security through scope minimization and Marketplace review governance.