To reproduce, create an app password and set read only. Create a session with the app password, eg with goat, and then create a record. Tranquil accepts the write.
The issue is that scope checks are only made if the auth method is OAuth. Scope checks need to be included for app passwords too.
