// Verify that the requested scopes match what the environment should usefunctionvalidateAdobeScopes(scopes: string, environment: string): void {
const scopeList = scopes.split(',').map(s => s.trim());
// Development should only have minimal scopesif (environment === 'development') {
const prodOnlyScopes = ['ff_apis'];
const violations = scopeList.filter(s => prodOnlyScopes.includes(s));
if (violations.length > 0) {
console.warn(`Adobe scope warning: ${violations.join(', ')} should not be in development`);
}
}
// Required scopes that should always be presentconst required = ['openid', 'AdobeID'];
const missing = required.filter(s => !scopeList.includes(s));
if (missing.length > 0) {
thrownewError(`Adobe required scopes missing: ${missing.join(', ')}`);
}
}
Guardrail 5: Runtime Operation Guard
// Prevent dangerous operations based on environmentconstBLOCKED_IN_PROD: Record<string, string> = {
'delete-all-assets': 'Mass deletion blocked in production',
'reset-quota-counter': 'Quota reset blocked in production',
'use-test-credentials': 'Test credentials blocked in production',
};
functionguardAdobeOperation(operation: string): void {
const isProd = process.env.NODE_ENV === 'production';
if (isProd && BLOCKED_IN_PROD[operation]) {
thrownewError(`BLOCKED: ${BLOCKED_IN_PROD[operation]}`);
}
}
Output
CI secret scanning for Adobe credential patterns (p8_, JWTs, Org IDs)
Firefly prompt pre-screening avoiding wasted credits on policy violations
PDF Services quota enforcement with monthly tracking
OAuth scope validation per environment
Runtime operation guards for production safety
Error Handling
Issue
Cause
Solution
Secret scan false positive
Test fixture contains pattern
Exclude test dirs from scan
Prompt wrongly rejected
Pattern too broad
Refine regex; allow legitimate uses
Quota counter reset
Server restart
Persist counter in Redis/DB
Scope validation fails
Wrong env var
Check NODE_ENV and ADOBE_SCOPES
Examples
Start with the smallest applicable command or code example already provided in this guide, using a non-production Adobe environment and credentials. Confirm the documented response or validation result before applying the pattern to production.
