SMS had one scope. A key that could send a message could also delete a suppression, change a sender, edit the destination allowlist, and file a 10DLC registration. There was no way to hand someone SMS configuration without also handing them the ability to send, and no way to give support read-only access without write.

That splits today, the way Email and WhatsApp already did. `sms` keeps sending and the message log. Everything that configures the channel moves to a new `sms_management` scope.

## What moves

`sms_management` now covers senders and their country registrations, 10DLC brands and campaigns, toll-free verification, suppressions, keyword replies, the destination allowlist, and templates.

`sms` keeps `POST /v1/sms/messages`, the batch send, the message log and its events, and SMS statistics.

Both scopes take `read` and `write`, and every built-in role holds the same level on both, so nothing changes for people in the dashboard. Admins and developers manage SMS as before; analysts still read it.

## If you call these from an API key

**Four operations change what they require, and existing keys are affected.** `GET /v1/sms/templates`, `GET /v1/sms/templates/{template_ref}`, `GET /v1/sms/destinations` and `PUT /v1/sms/destinations` now need `sms_management` and return `403` for a key holding only `sms`. The same applies to `bird sms templates` and `bird sms destinations` on the CLI, and to the matching MCP tools.

A key's scopes are fixed when it is issued and cannot be changed, so the fix is a new key. Create one with both `sms` and `sms_management` from **Developers → API keys**, swap it in, and revoke the old one. On the CLI, `bird login` again: a fresh token carries `sms_management:read`.

The other management endpoints are reachable only from the dashboard, which already carries the new scope.

## Granting less

The point of the split is the key you can now mint. A service that only sends holds `sms:write` and cannot touch a suppression. A support tool that reads senders and registrations holds `sms_management:read` and can send nothing. Grant the narrowest pair that works.