diff --git a/forge/db/controllers/Team.js b/forge/db/controllers/Team.js
index 51b54095ad..0406896c6e 100644
--- a/forge/db/controllers/Team.js
+++ b/forge/db/controllers/Team.js
@@ -134,6 +134,37 @@ module.exports = {
             }
             await userRole.destroy()
 
+            // Clean up scoped PAT entries that reference this team.
+            // Find which tokens had scopes for this team, remove those
+            // entries, then delete any tokens left with zero team scopes
+            // (they were scoped exclusively to the removed team and would
+            // otherwise silently escalate to team-global access).
+            const affectedScopes = await app.db.models.AccessTokenTeamScope.findAll({
+                where: { UserId: user.id, TeamId: team.id },
+                attributes: ['AccessTokenId']
+            })
+            const affectedTokenIds = affectedScopes.map(s => s.AccessTokenId)
+            if (affectedTokenIds.length > 0) {
+                await app.db.sequelize.transaction(async (t) => {
+                    await app.db.models.AccessTokenTeamScope.destroy({
+                        where: { UserId: user.id, TeamId: team.id },
+                        transaction: t
+                    })
+                    for (const tokenId of affectedTokenIds) {
+                        const remaining = await app.db.models.AccessTokenTeamScope.count({
+                            where: { AccessTokenId: tokenId },
+                            transaction: t
+                        })
+                        if (remaining === 0) {
+                            await app.db.models.AccessToken.destroy({
+                                where: { id: tokenId },
+                                transaction: t
+                            })
+                        }
+                    }
+                })
+            }
+
             await app.db.controllers.StorageSession.removeUserFromTeamSessions(user, team)
 
             return true
diff --git a/forge/routes/api/admin.js b/forge/routes/api/admin.js
index 137644c44d..cbeeb383a3 100644
--- a/forge/routes/api/admin.js
+++ b/forge/routes/api/admin.js
@@ -401,7 +401,7 @@ module.exports = async function (app) {
     })
 
     app.post('/expert-agent-creds', {
-        preHandler: app.needsPermission('platform:expert-agent:creds'),
+        preHandler: [app.blockPAT, app.needsPermission('platform:expert-agent:creds')],
         schema: {
             summary: 'Regenerate expert agent credentials - admin-only',
             tags: ['Platform'],
diff --git a/forge/routes/api/device.js b/forge/routes/api/device.js
index d1775b2be4..a5bfbed67a 100644
--- a/forge/routes/api/device.js
+++ b/forge/routes/api/device.js
@@ -875,7 +875,7 @@ module.exports = async function (app) {
      * Start device logging
      */
     app.post('/:deviceId/logs', {
-        preHandler: app.needsPermission('device:read'),
+        preHandler: [app.blockPAT, app.needsPermission('device:read')],
         schema: {
             summary: 'Start device logging',
             tags: ['Devices'],
@@ -909,10 +909,10 @@ module.exports = async function (app) {
     })
 
     /**
-     * Start device resouce stream
+     * Start a device resource stream
      */
     app.post('/:deviceId/resources', {
-        preHandler: app.needsPermission('device:read'),
+        preHandler: [app.blockPAT, app.needsPermission('device:read')],
         schema: {
             summary: 'Start device logging',
             tags: ['Devices'],
diff --git a/forge/routes/api/team.js b/forge/routes/api/team.js
index 1bb5067e15..12c11c7b15 100644
--- a/forge/routes/api/team.js
+++ b/forge/routes/api/team.js
@@ -952,7 +952,7 @@ module.exports = async function (app) {
      * @name /api/v1/teams/:teamId/comms-credentials
      */
     app.post('/:teamId/comms-credentials', {
-        preHandler: app.needsPermission('team:read'),
+        preHandler: [app.blockPAT, app.needsPermission('team:read')],
         schema: {
             summary: 'Issue team-channel broker credentials for the current user/session',
             tags: ['Teams'],
diff --git a/forge/routes/api/user.js b/forge/routes/api/user.js
index 212e09d52a..8e0cdd7f7e 100644
--- a/forge/routes/api/user.js
+++ b/forge/routes/api/user.js
@@ -435,7 +435,7 @@ module.exports = async function (app) {
      * Initialize expert chat
      */
     app.post('/expert-creds', {
-        // preHandler: app.needsPermission('xxx'), // all users can start an expert chat, but we might want to add a permission later
+        preHandler: app.blockPAT,
         schema: {
             summary: 'Initialize expert chat',
             tags: ['User'],
diff --git a/forge/routes/auth/index.js b/forge/routes/auth/index.js
index 35f6bae4bd..220c7cd15a 100644
--- a/forge/routes/auth/index.js
+++ b/forge/routes/auth/index.js
@@ -150,6 +150,20 @@ async function init (app, opts) {
                             request.requestContext.set('isPAT', true)
                             request.requestContext.set('pat', patMetadata)
 
+                            // When adminOptIn is false, shadow the admin flag on
+                            // the session User so all downstream permission checks
+                            // treat this request as non-admin.
+                            // Using Object.defineProperty instead of direct assignment
+                            // to avoid mutating the Sequelize model's dataValues,
+                            // which would persist to the database if .save() is
+                            // called later in the request lifecycle.
+                            if (request.session.User.admin && !patMetadata.adminOptIn) {
+                                Object.defineProperty(request.session.User, 'admin', {
+                                    value: false,
+                                    configurable: true
+                                })
+                            }
+
                             // Temp hack to give token full user scope
                             delete request.session.scope
                         }
diff --git a/forge/routes/auth/permissions.js b/forge/routes/auth/permissions.js
index 15a713be0c..ab22033e51 100644
--- a/forge/routes/auth/permissions.js
+++ b/forge/routes/auth/permissions.js
@@ -1,7 +1,35 @@
+const { requestContext } = require('@fastify/request-context')
 const fp = require('fastify-plugin')
 
 const { Permissions } = require('../../lib/permissions')
 const { Roles } = require('../../lib/roles.js')
+
+/**
+ * Check whether a PAT's teamScopes allow access to the given team.
+ * @param {object|null} pat - The PAT metadata object (from session or requestContext)
+ * @param {string} teamHashId - The hashid of the team being accessed
+ * @returns {boolean} true if access is allowed, false if denied
+ */
+function patAllowsTeam (pat, teamHashId) {
+    if (!pat.teamScopes) {
+        return true
+    }
+    return pat.teamScopes.some(scope => Object.prototype.hasOwnProperty.call(scope, teamHashId))
+}
+
+/**
+ * Check whether a PAT's readOnly flag allows the given permission.
+ * @param {object|null} pat - The PAT metadata object
+ * @param {string} scope - The permission scope string
+ * @returns {boolean} true if access is allowed, false if denied
+ */
+function patAllowsWrite (pat, scope) {
+    if (!pat.readOnly) {
+        return true
+    }
+    const permission = Permissions[scope]
+    return !permission || permission.access === 'read'
+}
 // For device/project tokens, list the scopes they implicitly have.
 // This will allow us to add scopes to existing tokens without having to update
 // them (as that requires reprovisioning of devices and restaging of projects)
@@ -61,6 +89,20 @@ module.exports = fp(async function (app, opts) {
         if (!teamMembership) {
             return false
         }
+
+        // PAT scope enforcement via requestContext (set during auth).
+        const isPAT = requestContext.get('isPAT')
+        if (isPAT) {
+            const pat = requestContext.get('pat')
+            if (!patAllowsWrite(pat, scope)) {
+                return false
+            }
+            const teamHashId = app.db.models.Team.encodeHashid(teamMembership.TeamId)
+            if (!patAllowsTeam(pat, teamHashId)) {
+                return false
+            }
+        }
+
         let userRole = teamMembership.role
         // Granular RBAC; if the request provides an application context for the request, check against
         // the teamMembership.permissions object
@@ -80,8 +122,23 @@ module.exports = fp(async function (app, opts) {
         return async (request, reply) => {
             if (!request.session.scope && request.session.User && request.session.User.admin) {
                 // Admins get to have all the fun - as long as they are logged in and not
-                // using an access-token which has a reduced scope
-                return
+                // using an access-token which has a reduced scope.
+                // For PATs without adminOptIn, the admin flag is already stripped
+                // at the auth layer, but we double-check here as defense in depth.
+                if (!request.session.pat || request.session.pat.adminOptIn) {
+                    // Even with admin bypass, PAT readOnly and teamScope still apply
+                    if (request.session.pat) {
+                        if (!patAllowsWrite(request.session.pat, scope)) {
+                            reply.code(403).send({ code: 'unauthorized', error: 'unauthorized' })
+                            throw new Error()
+                        }
+                        if (request.team && !patAllowsTeam(request.session.pat, request.team.hashid)) {
+                            reply.code(403).send({ code: 'unauthorized', error: 'unauthorized' })
+                            throw new Error()
+                        }
+                    }
+                    return
+                }
             }
             // A user has permission based on:
             // - the resource they are accessing
@@ -138,6 +195,19 @@ module.exports = fp(async function (app, opts) {
                     }
                 }
             }
+            // PAT scope enforcement: check team scope and read-only restrictions.
+            // This runs after the standard permission checks pass, as an
+            // additional restriction layer for PAT-authenticated requests.
+            if (request.session.pat) {
+                if (request.team && !patAllowsTeam(request.session.pat, request.team.hashid)) {
+                    reply.code(403).send({ code: 'unauthorized', error: 'unauthorized' })
+                    throw new Error()
+                }
+                if (!patAllowsWrite(request.session.pat, scope)) {
+                    reply.code(403).send({ code: 'unauthorized', error: 'unauthorized' })
+                    throw new Error()
+                }
+            }
             if (request.session.scope) {
                 // All things being equal, the user does have this permission
                 // But they are using an access_token that could be scoped down
diff --git a/frontend/src/api/user.js b/frontend/src/api/user.js
index 3f1c21c37d..90abf96994 100644
--- a/frontend/src/api/user.js
+++ b/frontend/src/api/user.js
@@ -204,14 +204,17 @@ const getPersonalAccessTokens = async () => {
 }
 
 /**
- * Create new User Personal Access Token
+ * Create a new User Personal Access Token
  * See [routes/api/user.js](../../../forge/routes/api/user.js)
  * @param {string} name
  * @param {string} scope
  * @param {number} expiresAt
+ * @param {boolean} readOnly
+ * @param {boolean} adminOptIn
+ * @param {Array<string>} teamIds
  */
-const createPersonalAccessToken = async (name, scope, expiresAt) => {
-    return client.post('/api/v1/user/tokens', { name, scope, expiresAt }).then(res => res.data)
+const createPersonalAccessToken = async (name, scope, expiresAt, { readOnly, adminOptIn, teamIds } = {}) => {
+    return client.post('/api/v1/user/tokens', { name, scope, expiresAt, readOnly, adminOptIn, teamIds }).then(res => res.data)
 }
 
 /**
@@ -224,10 +227,18 @@ const deletePersonalAccessToken = async (id) => {
 }
 
 /**
- * Update User Personal Token
+ * Update User Personal Access Token
+ * See [routes/api/user.js](../../../forge/routes/api/user.js)
+ * @param {string} id The token ID to update
+ * @param {string} scope The token scope
+ * @param {number} expiresAt Expiration timestamp
+ * @param {Object} options Optional configuration
+ * @param {boolean} options.readOnly Whether the token is read-only
+ * @param {boolean} options.adminOptIn Whether admin opt-in is enabled
+ * @param {Array<string>} options.teamIds Array of team IDs the token is scoped to
  */
-const updatePersonalAccessToken = async (id, scope, expiresAt) => {
-    return client.put('/api/v1/user/tokens/' + id, { scope, expiresAt })
+const updatePersonalAccessToken = async (id, scope, expiresAt, { readOnly, adminOptIn, teamIds } = {}) => {
+    return client.put('/api/v1/user/tokens/' + id, { scope, expiresAt, readOnly, adminOptIn, teamIds }).then(res => res.data)
 }
 
 const enableMFA = async () => {
diff --git a/frontend/src/pages/account/Security/Tokens.vue b/frontend/src/pages/account/Security/Tokens.vue
index 560f50f451..03e97813a9 100644
--- a/frontend/src/pages/account/Security/Tokens.vue
+++ b/frontend/src/pages/account/Security/Tokens.vue
@@ -9,7 +9,7 @@
         <template #actions>
             <ff-button data-action="new-token" @click="newToken()">
                 <template #icon-left>
-                    <PlusSmallIcon />
+                    <PlusIcon />
                 </template>
                 Add Token
             </ff-button>
@@ -29,7 +29,7 @@
 </template>
 
 <script>
-import { PlusSmallIcon } from '@heroicons/vue/24/outline'
+import { PlusIcon } from '@heroicons/vue/24/outline'
 import { markRaw } from 'vue'
 
 import userApi from '../../../api/user.js'
@@ -40,10 +40,13 @@ import ExpiryCell from '../components/ExpiryCell.vue'
 import TokenCreated from './dialogs/TokenCreated.vue'
 import TokenDialog from './dialogs/TokenDialog.vue'
 
+import { pluralize } from '@/composables/strings/String.js'
+import { useAccountAuthStore } from '@/stores/account-auth.js'
+
 export default {
     name: 'PersonalAccessTokens',
     components: {
-        PlusSmallIcon,
+        PlusIcon,
         SectionTopMenu,
         TokenDialog,
         TokenCreated
@@ -51,10 +54,67 @@ export default {
     data () {
         return {
             loading: false,
-            tokens: [],
-            columns: [
+            tokens: []
+        }
+    },
+    computed: {
+        isAdmin () {
+            return useAccountAuthStore().isAdminUser
+        },
+        columns () {
+            return [
                 { label: 'Name', key: 'name', sortable: true },
-                // { label: 'Scope', key: 'scope' },
+                {
+                    label: 'Teams',
+                    key: 'teams',
+                    sortable: false,
+                    component: {
+                        is: markRaw({
+                            name: 'TeamsCell',
+                            props: ['teams'],
+                            template: '<span :title="tooltip" style="cursor:help">{{ label }}</span>',
+                            computed: {
+                                label () {
+                                    if (!this.teams || this.teams.length === 0) {
+                                        return 'All Teams'
+                                    }
+                                    return 'Team Scoped'
+                                },
+                                tooltip () {
+                                    if (!this.teams || this.teams.length === 0) {
+                                        return 'This token has access to all teams in your account'
+                                    }
+                                    return `This Token is scoped to the following ${pluralize('team', this.teams.length)}: \n${this.teams.map(t => t.name).join('\n')}`
+                                }
+                            }
+                        })
+                    }
+                },
+                {
+                    label: 'Read Only',
+                    key: 'readOnly',
+                    sortable: false,
+                    component: {
+                        is: markRaw({
+                            name: 'ReadOnlyCell',
+                            props: ['readOnly'],
+                            template: '<span v-if="readOnly" class="ff-badge ff-badge--info">Read Only</span><span v-else></span>'
+                        })
+                    }
+                },
+                {
+                    label: 'Admin Access',
+                    key: 'adminOptIn',
+                    sortable: false,
+                    hidden: !this.isAdmin,
+                    component: {
+                        is: markRaw({
+                            name: 'AdminOptInCell',
+                            props: ['adminOptIn'],
+                            template: '<span v-if="adminOptIn" class="text-green-500">&#x2714;</span><span v-else class="text-red-500">&#x2718;</span>'
+                        })
+                    }
+                },
                 {
                     label: 'Expires',
                     key: 'expiresAt',
@@ -62,7 +122,7 @@ export default {
                         is: markRaw(ExpiryCell)
                     }
                 }
-            ]
+            ].filter(col => !col.hidden)
         }
     },
     mounted () {
diff --git a/frontend/src/pages/account/Security/dialogs/TokenDialog.vue b/frontend/src/pages/account/Security/dialogs/TokenDialog.vue
index 7497db9cdb..3876e9aed0 100644
--- a/frontend/src/pages/account/Security/dialogs/TokenDialog.vue
+++ b/frontend/src/pages/account/Security/dialogs/TokenDialog.vue
@@ -2,24 +2,73 @@
     <ff-dialog ref="dialog" data-el="add-token-dialog" :header="(token ? 'Edit' : 'Add') + ' Token'" :confirm-label="token ? 'Save' : 'Create'" :disablePrimary="disableConfirm" @confirm="confirm()">
         <template #default>
             <form class="space-y-4" @submit.prevent>
-                <FormRow v-model="input.name" data-form="token-name" :disabled="edit">
-                    Token name
-                </FormRow>
-                <ff-checkbox v-model="input.expires" data-form="expiry-toggle" label="Add Expiry Date" />
-                <FormRow v-model="input.expiresAt" data-form="token-expiry" type="date" :disabled="!input.expires">
-                    Expires
-                    <!-- <template v-slot:description>Expires</template> -->
-                </FormRow>
+                <p class="text-sm text-gray-500">
+                    Personal access tokens allow external tools and scripts to authenticate with the platform API on your behalf.
+                    Configure the token's permissions below to control what it can access.
+                </p>
+
+                <!-- Token Name -->
+                <div class="border-t pt-4">
+                    <label class="block text-sm font-medium mb-1">Token Name</label>
+                    <p class="text-gray-500 text-sm mb-2">A descriptive name to help you identify this token later.</p>
+                    <FormRow v-model="input.name" data-form="token-name" :disabled="edit" />
+                </div>
+
+                <!-- Expiry -->
+                <div class="border-t pt-4">
+                    <label class="block text-sm font-medium mb-1">Expiry</label>
+                    <p class="text-gray-500 text-sm mb-2">Set an expiration date after which the token will stop working. Recommended for security.</p>
+                    <ff-checkbox v-model="input.expires" data-form="expiry-toggle" label="Add Expiry Date" />
+                    <div v-if="input.expires" class="mt-2 ml-6">
+                        <FormRow v-model="input.expiresAt" data-form="token-expiry" type="date" />
+                    </div>
+                </div>
+
+                <!-- Read Only -->
+                <div class="border-t pt-4">
+                    <label class="block text-sm font-medium mb-1">Access Level</label>
+                    <p class="text-gray-500 text-sm mb-2">Restrict this token to read-only operations. Write operations like creating, updating, or deleting resources will be denied.</p>
+                    <ff-checkbox v-model="input.readOnly" data-form="readonly-toggle" label="Read Only" />
+                </div>
+
+                <!-- Team Scope -->
+                <div class="border-t pt-4">
+                    <label class="block text-sm font-medium mb-1">Team Scope</label>
+                    <p class="text-gray-500 text-sm mb-2">Limit this token to specific teams. If none are selected, the token can access all teams you belong to.</p>
+                    <div v-if="teams.length > 0" class="space-y-2 ml-2">
+                        <ff-checkbox
+                            v-for="team in teams"
+                            :key="team.id"
+                            :model-value="input.teamIds.includes(team.id)"
+                            :label="team.name"
+                            :data-form="'team-scope-' + team.id"
+                            @update:model-value="toggleTeam(team.id)"
+                        />
+                    </div>
+                    <div v-if="input.teamIds.length === 0" class="mt-2 text-sm text-yellow-600">
+                        This token will have access to all teams you belong to, including teams you join in the future.
+                    </div>
+                </div>
+
+                <!-- Admin Opt-In -->
+                <div v-if="isAdmin" class="border-t pt-4">
+                    <label class="block text-sm font-medium mb-1">Admin Access</label>
+                    <p class="text-gray-500 text-sm mb-2">By default, tokens do not carry admin privileges even if your account is an admin. Enable this to grant admin-level access to the token.</p>
+                    <ff-checkbox v-model="input.adminOptIn" data-form="admin-optin-toggle" label="Enable Admin Privileges" />
+                </div>
             </form>
         </template>
     </ff-dialog>
 </template>
 
 <script>
-import userApi from '../../../../api/user.js'
+import { mapState } from 'pinia'
 
 import FormRow from '../../../../components/FormRow.vue'
 
+import userApi from '@/api/user.js'
+import { useAccountAuthStore, useAccountStore } from '@/stores/index.js'
+
 export default {
     name: 'TokenDialog',
     components: {
@@ -35,7 +84,10 @@ export default {
                     id: null,
                     name: '',
                     expiresAt: null,
-                    expires: false
+                    expires: false,
+                    readOnly: false,
+                    adminOptIn: false,
+                    teamIds: []
                 }
                 this.edit = false
             },
@@ -43,13 +95,16 @@ export default {
                 this.token = row
                 this.input = {
                     id: row.id,
-                    name: row.name
+                    name: row.name,
+                    readOnly: row.readOnly ?? false,
+                    adminOptIn: row.adminOptIn ?? false,
+                    teamIds: (row.teams ?? []).map(t => t.id)
                 }
                 if (row.expiresAt === null) {
                     this.input.expires = false
                 } else {
                     this.input.expires = true
-                    this.input.expiresAt = row.expiresAt.split('T')[0] // `${d.getFullYear()}-${d.getMonth()+1}-${d.getDate()}`
+                    this.input.expiresAt = row.expiresAt.split('T')[0]
                 }
                 this.edit = true
                 this.$refs.dialog.show()
@@ -65,35 +120,41 @@ export default {
                 name: '',
                 scope: {},
                 expiresAt: null,
-                expires: true
+                expires: true,
+                readOnly: false,
+                adminOptIn: false,
+                teamIds: []
             },
             edit: false
         }
     },
     computed: {
-        dialogTitle () {
-            if (this.token) {
-                return 'Update token'
-            } else {
-                return 'Create token'
-            }
+        ...mapState(useAccountStore, ['teams']),
+        isAdmin () {
+            return useAccountAuthStore().isAdminUser
         },
         disableConfirm () {
             if (!this.input.name) {
                 return true
             }
-            if (!this.input.expires) {
-                return false
-            } else {
-                if (this.input.expiresAt) {
-                    return false
-                }
-            }
-            return true
+            return this.input.expires && !this.input.expiresAt
         }
     },
     methods: {
+        toggleTeam (teamId) {
+            const idx = this.input.teamIds.indexOf(teamId)
+            if (idx === -1) {
+                this.input.teamIds.push(teamId)
+            } else {
+                this.input.teamIds.splice(idx, 1)
+            }
+        },
         confirm: async function () {
+            const scopeOpts = {
+                readOnly: this.input.readOnly,
+                adminOptIn: this.input.adminOptIn,
+                teamIds: this.edit ? this.input.teamIds : (this.input.teamIds.length > 0 ? this.input.teamIds : undefined)
+            }
             if (!this.edit) {
                 let array = []
                 if (this.input.scope) {
@@ -106,7 +167,7 @@ export default {
                 if (this.input.expires) {
                     request.expiresAt = Date.parse(this.input.expiresAt)
                 }
-                const token = await userApi.createPersonalAccessToken(request.name, request.scope, request.expiresAt)
+                const token = await userApi.createPersonalAccessToken(request.name, request.scope, request.expiresAt, scopeOpts)
                 this.$emit('token-created', token)
             } else {
                 let array = []
@@ -124,7 +185,7 @@ export default {
                 }
 
                 try {
-                    await userApi.updatePersonalAccessToken(request.id, request.scope, request.expiresAt)
+                    await userApi.updatePersonalAccessToken(request.id, request.scope, request.expiresAt, scopeOpts)
                 } catch (err) {
                     console.error(err)
                 }
diff --git a/test/e2e/frontend/cypress/tests/account/tokens.spec.js b/test/e2e/frontend/cypress/tests/account/tokens.spec.js
index f62e1092bb..c1bef9716b 100644
--- a/test/e2e/frontend/cypress/tests/account/tokens.spec.js
+++ b/test/e2e/frontend/cypress/tests/account/tokens.spec.js
@@ -13,9 +13,18 @@ describe('FlowFuse - Personal Access Tokens', () => {
         cy.get('[data-action="new-token"]').click()
         cy.get('[data-el="add-token-dialog"]').should('be.visible')
 
-        // expiry disabled by default
+        // expiry unchecked and date field hidden by default
         cy.get('[data-form="expiry-toggle"] input').should('not.be.checked')
-        cy.get('[data-form="token-expiry"] input').should('be.disabled')
+        cy.get('[data-form="token-expiry"]').should('not.exist')
+
+        // read-only unchecked by default
+        cy.get('[data-form="readonly-toggle"] input').should('not.be.checked')
+
+        // admin opt-in unchecked by default (alice is admin so it should be visible)
+        cy.get('[data-form="admin-optin-toggle"] input').should('not.be.checked')
+
+        // team scope warning visible when no teams selected
+        cy.contains('This token will have access to all teams you belong to').should('be.visible')
 
         cy.get('[data-el="add-token-dialog"]').within(() => {
             // check primary is disabled by default
@@ -30,6 +39,22 @@ describe('FlowFuse - Personal Access Tokens', () => {
         cy.get('[data-el="add-token-dialog"]').should('not.be.visible')
     })
 
+    it('expiry date field appears when expiry is toggled on', () => {
+        cy.get('[data-action="new-token"]').click()
+
+        // date field should not exist initially
+        cy.get('[data-form="token-expiry"]').should('not.exist')
+
+        // toggle expiry on
+        cy.get('[data-form="expiry-toggle"]').click()
+        cy.get('[data-form="token-expiry"]').should('exist')
+        cy.get('[data-form="token-expiry"] input').should('not.be.disabled')
+
+        // toggle expiry off
+        cy.get('[data-form="expiry-toggle"]').click()
+        cy.get('[data-form="token-expiry"]').should('not.exist')
+    })
+
     it('can be added without an expiry', () => {
         const TOKEN_NAME = 'Token 1'
         // count how many tokens we already have
@@ -89,6 +114,66 @@ describe('FlowFuse - Personal Access Tokens', () => {
         cy.get('[data-el="tokens-table"] tbody').find('tr').last().should('contain', '2050')
     })
 
+    it('can be added with read-only enabled', () => {
+        cy.intercept('POST', '/api/*/user/tokens').as('addPersonalAccessToken')
+
+        cy.get('[data-action="new-token"]').click()
+        cy.get('[data-form="token-name"] input').type('ReadOnly Token')
+        cy.get('[data-form="readonly-toggle"]').click()
+
+        cy.get('[data-el="add-token-dialog"] [data-action="dialog-confirm"]').click()
+
+        cy.wait('@addPersonalAccessToken').its('request.body').should('have.property', 'readOnly', true)
+
+        cy.get('[data-el="add-token-confirmation"]').should('be.visible')
+        cy.get('[data-el="add-token-confirmation"] [data-action="token-confirmation-done"]').click()
+
+        // token list should show Read Only badge
+        cy.get('[data-el="tokens-table"] tbody').find('tr').last().should('contain', 'Read Only')
+    })
+
+    it('can be added with team scope', () => {
+        cy.intercept('POST', '/api/*/user/tokens').as('addPersonalAccessToken')
+
+        cy.get('[data-action="new-token"]').click()
+        cy.get('[data-form="token-name"] input').type('Team Scoped Token')
+
+        // select the first team
+        cy.get('[data-form^="team-scope-"]').first().click()
+
+        // warning should disappear when a team is selected
+        cy.contains('This token will have access to all teams you belong to').should('not.exist')
+
+        cy.get('[data-el="add-token-dialog"] [data-action="dialog-confirm"]').click()
+
+        cy.wait('@addPersonalAccessToken').its('request.body').should('have.property', 'teamIds')
+
+        cy.get('[data-el="add-token-confirmation"]').should('be.visible')
+        cy.get('[data-el="add-token-confirmation"] [data-action="token-confirmation-done"]').click()
+
+        // token list should show Team Scoped
+        cy.get('[data-el="tokens-table"] tbody').find('tr').last().should('contain', 'Team Scoped')
+    })
+
+    it('can be added with admin opt-in', () => {
+        cy.intercept('POST', '/api/*/user/tokens').as('addPersonalAccessToken')
+
+        cy.get('[data-action="new-token"]').click()
+        cy.get('[data-form="token-name"] input').type('Admin Token')
+        cy.get('[data-form="admin-optin-toggle"]').click()
+
+        cy.get('[data-el="add-token-dialog"] [data-action="dialog-confirm"]').click()
+
+        cy.wait('@addPersonalAccessToken').its('request.body').should('have.property', 'adminOptIn', true)
+
+        cy.get('[data-el="add-token-confirmation"]').should('be.visible')
+        cy.get('[data-el="add-token-confirmation"] [data-action="token-confirmation-done"]').click()
+    })
+
+    it('token list shows All Teams for unscoped tokens', () => {
+        cy.get('[data-el="tokens-table"] tbody').find('tr').first().should('contain', 'All Teams')
+    })
+
     it('can be removed', () => {
         // count how many tokens we already have
         const rows = Cypress.$('[data-el="tokens-table"] tbody').find('tr.ff-data-table--row').length
diff --git a/test/unit/forge/routes/api/teamMembers_spec.js b/test/unit/forge/routes/api/teamMembers_spec.js
index 6d13c7c081..03c797c723 100644
--- a/test/unit/forge/routes/api/teamMembers_spec.js
+++ b/test/unit/forge/routes/api/teamMembers_spec.js
@@ -637,4 +637,109 @@ describe('Team Members API', function () {
             secondResponse.statusCode.should.equal(200)
         })
     })
+
+    describe('PAT team scope cleanup on member removal', function () {
+        before(async function () {
+            if (app) await app.close()
+            app = await setup()
+            TestObjects.ATeam = await app.db.models.Team.byName('ATeam')
+            TestObjects.BTeam = await app.db.models.Team.create({ name: 'BTeam', TeamTypeId: app.defaultTeamType.id })
+            TestObjects.CTeam = await app.db.models.Team.create({ name: 'CTeam', TeamTypeId: app.defaultTeamType.id })
+            delete TestObjects.DTeam
+        })
+        after(async function () {
+            await app.close()
+        })
+
+        it('removing user from team deletes AccessTokenTeamScope entries for that team', async function () {
+            await setupUsers()
+            // bob is member of ATeam and BTeam. Create a PAT scoped to both.
+            const token = await app.db.controllers.AccessToken.createPersonalAccessToken(
+                TestObjects.bob, '', null, 'Multi Team PAT',
+                { teamIds: [TestObjects.ATeam.hashid, TestObjects.BTeam.hashid] }
+            )
+
+            // Verify both scopes exist
+            let scopes = await app.db.models.AccessTokenTeamScope.findAll({
+                where: { UserId: TestObjects.bob.id }
+            })
+            scopes.should.have.length(2)
+
+            // Remove bob from ATeam
+            await app.db.controllers.Team.removeUser(TestObjects.ATeam, TestObjects.bob)
+
+            // ATeam scope should be gone, BTeam scope should remain
+            scopes = await app.db.models.AccessTokenTeamScope.findAll({
+                where: { UserId: TestObjects.bob.id }
+            })
+            scopes.should.have.length(1)
+            scopes[0].TeamId.should.equal(TestObjects.BTeam.id)
+
+            // Token itself should still exist
+            const tokenRecord = await app.db.models.AccessToken.findOne({
+                where: { id: app.db.models.AccessToken.decodeHashid(token.id) }
+            })
+            should(tokenRecord).not.be.null()
+        })
+
+        it('deletes token when last team scope is removed', async function () {
+            await setupUsers()
+            // bob is member of ATeam. Create a PAT scoped only to ATeam.
+            const token = await app.db.controllers.AccessToken.createPersonalAccessToken(
+                TestObjects.bob, '', null, 'Single Team PAT',
+                { teamIds: [TestObjects.ATeam.hashid] }
+            )
+            const tokenId = app.db.models.AccessToken.decodeHashid(token.id)
+
+            // Remove bob from ATeam: last scope removed, token should be deleted
+            await app.db.controllers.Team.removeUser(TestObjects.ATeam, TestObjects.bob)
+
+            const tokenRecord = await app.db.models.AccessToken.findOne({ where: { id: tokenId } })
+            should(tokenRecord).be.null()
+
+            const scopes = await app.db.models.AccessTokenTeamScope.findAll({
+                where: { UserId: TestObjects.bob.id }
+            })
+            scopes.should.have.length(0)
+        })
+
+        it('team-agnostic tokens are unaffected by membership removal', async function () {
+            await setupUsers()
+            // Create a PAT with no team scopes
+            const token = await app.db.controllers.AccessToken.createPersonalAccessToken(
+                TestObjects.bob, '', null, 'Global PAT'
+            )
+            const tokenId = app.db.models.AccessToken.decodeHashid(token.id)
+
+            // Remove bob from ATeam
+            await app.db.controllers.Team.removeUser(TestObjects.ATeam, TestObjects.bob)
+
+            // Token should still exist
+            const tokenRecord = await app.db.models.AccessToken.findOne({ where: { id: tokenId } })
+            should(tokenRecord).not.be.null()
+        })
+
+        it('tokens scoped to other teams are unaffected', async function () {
+            await setupUsers()
+            // Create a PAT scoped only to BTeam
+            const token = await app.db.controllers.AccessToken.createPersonalAccessToken(
+                TestObjects.bob, '', null, 'BTeam Only PAT',
+                { teamIds: [TestObjects.BTeam.hashid] }
+            )
+            const tokenId = app.db.models.AccessToken.decodeHashid(token.id)
+
+            // Remove bob from ATeam (not BTeam)
+            await app.db.controllers.Team.removeUser(TestObjects.ATeam, TestObjects.bob)
+
+            // Token and its BTeam scope should be untouched
+            const tokenRecord = await app.db.models.AccessToken.findOne({ where: { id: tokenId } })
+            should(tokenRecord).not.be.null()
+
+            const scopes = await app.db.models.AccessTokenTeamScope.findAll({
+                where: { AccessTokenId: tokenId }
+            })
+            scopes.should.have.length(1)
+            scopes[0].TeamId.should.equal(TestObjects.BTeam.id)
+        })
+    })
 })
diff --git a/test/unit/forge/routes/api/user_spec.js b/test/unit/forge/routes/api/user_spec.js
index 14491e48a2..8cb1eef8a2 100644
--- a/test/unit/forge/routes/api/user_spec.js
+++ b/test/unit/forge/routes/api/user_spec.js
@@ -973,14 +973,14 @@ describe('User API', async function () {
 
             const response2 = await app.inject({
                 method: 'GET',
-                url: `/api/v1/teams/${TestObjects.BTeam.hashid}`,
+                url: `/api/v1/teams/${TestObjects.ATeam.hashid}`,
                 headers: {
                     authorization: `Bearer ${token}`
                 }
             })
             response2.statusCode.should.equal(200)
             const team = response2.json()
-            team.name.should.equal('BTeam')
+            team.name.should.equal('ATeam')
         })
         it('User cannot modify/delete a token they do not own', async function () {
             await login('bob', 'bbPassword')
@@ -1319,6 +1319,300 @@ describe('User API', async function () {
                 accessToken.AccessTokenTeamScopes.should.have.length(0)
             })
         })
+
+        describe('PAT scope enforcement', async function () {
+            // alice: admin, ATeam owner
+            // bob: admin, ATeam owner, BTeam owner
+
+            it('team-scoped PAT can access allowed team', async function () {
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: {
+                        name: 'ATeam Scoped',
+                        scope: '',
+                        teamIds: [TestObjects.ATeam.hashid]
+                    }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                const response = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.ATeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                response.statusCode.should.equal(200)
+                response.json().should.have.property('name', 'ATeam')
+            })
+
+            it('team-scoped PAT cannot access a team outside its scope', async function () {
+                await login('bob', 'bbPassword')
+                // bob is member of both ATeam and BTeam, but scope the PAT to ATeam only
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.bob },
+                    payload: {
+                        name: 'ATeam Only',
+                        scope: '',
+                        teamIds: [TestObjects.ATeam.hashid]
+                    }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // Accessing BTeam should fail
+                const response = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.BTeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                // 404 from the shared team preHandler nullifying membership,
+                // or 403 from needsPermission team scope check
+                response.statusCode.should.be.oneOf([403, 404])
+            })
+
+            it('team-agnostic PAT (no teamScopes) can access any team the user belongs to', async function () {
+                await login('bob', 'bbPassword')
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.bob },
+                    payload: { name: 'No Scope', scope: '' }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // Can access both ATeam and BTeam
+                const aResponse = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.ATeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                aResponse.statusCode.should.equal(200)
+
+                const bResponse = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.BTeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                bResponse.statusCode.should.equal(200)
+            })
+
+            it('read-only PAT can call read endpoints', async function () {
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: {
+                        name: 'ReadOnly PAT',
+                        scope: '',
+                        readOnly: true
+                    }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // GET team (read) should succeed
+                const response = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.ATeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                response.statusCode.should.equal(200)
+            })
+
+            it('read-only PAT cannot call write endpoints', async function () {
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: {
+                        name: 'ReadOnly Write Test',
+                        scope: '',
+                        readOnly: true
+                    }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // PUT user (write) should be rejected
+                const response = await app.inject({
+                    method: 'PUT',
+                    url: '/api/v1/user',
+                    headers: { authorization: `Bearer ${patToken}` },
+                    payload: { name: 'Should Not Change' }
+                })
+                response.statusCode.should.equal(403)
+            })
+
+            it('adminOptIn: false strips admin privileges', async function () {
+                // alice is admin but PAT has adminOptIn: false (default)
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: { name: 'No Admin PAT', scope: '' }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // Admin-only endpoint (e.g. list all users) should be rejected
+                const response = await app.inject({
+                    method: 'GET',
+                    url: '/api/v1/admin/users',
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                response.statusCode.should.not.equal(200)
+            })
+
+            it('adminOptIn: true preserves admin privileges', async function () {
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: {
+                        name: 'Admin PAT',
+                        scope: '',
+                        adminOptIn: true
+                    }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // Admin can access a team they are not a member of
+                const response = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.BTeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                response.statusCode.should.equal(200)
+            })
+
+            it('adminOptIn: true + readOnly still enforces read-only', async function () {
+                const createResponse = await app.inject({
+                    method: 'POST',
+                    url: '/api/v1/user/tokens',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: {
+                        name: 'Admin ReadOnly',
+                        scope: '',
+                        adminOptIn: true,
+                        readOnly: true
+                    }
+                })
+                createResponse.statusCode.should.equal(200)
+                const patToken = createResponse.json().token
+
+                // Read should work (admin bypass + read-only allows reads)
+                const readResponse = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.ATeam.hashid}`,
+                    headers: { authorization: `Bearer ${patToken}` }
+                })
+                readResponse.statusCode.should.equal(200)
+
+                // Write should be blocked by read-only even though admin
+                const writeResponse = await app.inject({
+                    method: 'PUT',
+                    url: '/api/v1/user',
+                    headers: { authorization: `Bearer ${patToken}` },
+                    payload: { name: 'Should Not Change' }
+                })
+                writeResponse.statusCode.should.equal(403)
+            })
+
+            it('cookie session is unaffected by PAT enforcement', async function () {
+                // Cookie session should still have full access
+                const response = await app.inject({
+                    method: 'GET',
+                    url: `/api/v1/teams/${TestObjects.BTeam.hashid}`,
+                    cookies: { sid: TestObjects.tokens.alice }
+                })
+                response.statusCode.should.equal(200)
+
+                // Write should also work
+                const writeResponse = await app.inject({
+                    method: 'PUT',
+                    url: '/api/v1/user',
+                    cookies: { sid: TestObjects.tokens.alice },
+                    payload: { name: 'Alice Skywalker' }
+                })
+                writeResponse.statusCode.should.equal(200)
+            })
+
+            describe('broker credential endpoints blocked for PATs', async function () {
+                let patToken
+
+                before(async function () {
+                    await login('alice', 'aaPassword')
+                    const createResponse = await app.inject({
+                        method: 'POST',
+                        url: '/api/v1/user/tokens',
+                        cookies: { sid: TestObjects.tokens.alice },
+                        payload: { name: 'Broker Test PAT', scope: '', adminOptIn: true }
+                    })
+                    createResponse.statusCode.should.equal(200)
+                    patToken = createResponse.json().token
+                })
+
+                it('PAT cannot call POST /user/expert-creds', async function () {
+                    const response = await app.inject({
+                        method: 'POST',
+                        url: '/api/v1/user/expert-creds',
+                        headers: { authorization: `Bearer ${patToken}` },
+                        payload: { sessionId: 'abcd1234' }
+                    })
+                    response.statusCode.should.equal(403)
+                    response.json().should.have.property('code', 'pat_cannot_create_pat')
+                })
+
+                it('cookie session can call POST /user/expert-creds', async function () {
+                    const response = await app.inject({
+                        method: 'POST',
+                        url: '/api/v1/user/expert-creds',
+                        cookies: { sid: TestObjects.tokens.alice },
+                        payload: { sessionId: 'abcd1234' }
+                    })
+                    response.statusCode.should.equal(200)
+                })
+
+                it('PAT cannot call POST /teams/:teamId/comms-credentials', async function () {
+                    const response = await app.inject({
+                        method: 'POST',
+                        url: `/api/v1/teams/${TestObjects.ATeam.hashid}/comms-credentials`,
+                        headers: { authorization: `Bearer ${patToken}` },
+                        payload: { sessionId: 'abcd1234' } // somewhat defeats the purpose of this test but better safe than sorry
+                    })
+                    response.statusCode.should.equal(403)
+                    response.json().should.have.property('code', 'pat_cannot_create_pat')
+                })
+
+                it('PAT cannot call POST /devices/:deviceId/logs', async function () {
+                    const device = await app.factory.createDevice({ name: 'broker-test-device' }, TestObjects.ATeam, null, TestObjects.application)
+                    const response = await app.inject({
+                        method: 'POST',
+                        url: `/api/v1/devices/${device.hashid}/logs`,
+                        headers: { authorization: `Bearer ${patToken}` }
+                    })
+                    response.statusCode.should.equal(403)
+                    response.json().should.have.property('code', 'pat_cannot_create_pat')
+                })
+
+                it('PAT cannot call POST /devices/:deviceId/resources', async function () {
+                    const device = await app.factory.createDevice({ name: 'broker-test-device-2' }, TestObjects.ATeam, null, TestObjects.application)
+                    const response = await app.inject({
+                        method: 'POST',
+                        url: `/api/v1/devices/${device.hashid}/resources`,
+                        headers: { authorization: `Bearer ${patToken}` }
+                    })
+                    response.statusCode.should.equal(403)
+                    response.json().should.have.property('code', 'pat_cannot_create_pat')
+                })
+            })
+        })
     })
 
     describe('User invites', async function () {