diff --git a/src/Factory/ServiceAuthorizationRepositoryFactory.php b/src/Factory/ServiceAuthorizationRepositoryFactory.php
new file mode 100644
index 00000000..71ddee87
--- /dev/null
+++ b/src/Factory/ServiceAuthorizationRepositoryFactory.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Factory;
+
+use Horde\Core\Service\NullServiceAuthorizationRepository;
+use Horde\Core\Service\ServiceAuthorizationRepository;
+use Horde\Injector\Injector;
+
+/** Factory for ServiceAuthorizationRepository - defaults to NullServiceAuthorizationRepository. */
+class ServiceAuthorizationRepositoryFactory
+{
+    public function create(Injector $injector): ServiceAuthorizationRepository
+    {
+        return new NullServiceAuthorizationRepository();
+    }
+}
diff --git a/src/Factory/ServiceAuthorizationServiceFactory.php b/src/Factory/ServiceAuthorizationServiceFactory.php
new file mode 100644
index 00000000..b437fa8e
--- /dev/null
+++ b/src/Factory/ServiceAuthorizationServiceFactory.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Factory;
+
+use Horde\Core\Service\NullServiceAuthorizationService;
+use Horde\Core\Service\ServiceAuthorizationService;
+use Horde\Injector\Injector;
+
+/** Factory for ServiceAuthorizationService - defaults to NullServiceAuthorizationService. */
+class ServiceAuthorizationServiceFactory
+{
+    public function create(Injector $injector): ServiceAuthorizationService
+    {
+        return new NullServiceAuthorizationService();
+    }
+}
diff --git a/src/Factory/TokenGrantRepositoryFactory.php b/src/Factory/TokenGrantRepositoryFactory.php
new file mode 100644
index 00000000..60689386
--- /dev/null
+++ b/src/Factory/TokenGrantRepositoryFactory.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Factory;
+
+use Horde\Core\Service\NullTokenGrantRepository;
+use Horde\Core\Service\TokenGrantRepository;
+use Horde\Injector\Injector;
+
+/** Factory for TokenGrantRepository - defaults to NullTokenGrantRepository. */
+class TokenGrantRepositoryFactory
+{
+    public function create(Injector $injector): TokenGrantRepository
+    {
+        return new NullTokenGrantRepository();
+    }
+}
diff --git a/src/Service/Exception/OAuthTokenRefreshException.php b/src/Service/Exception/OAuthTokenRefreshException.php
index 1b397078..aef7619e 100644
--- a/src/Service/Exception/OAuthTokenRefreshException.php
+++ b/src/Service/Exception/OAuthTokenRefreshException.php
@@ -16,6 +16,7 @@
 
 namespace Horde\Core\Service\Exception;
 
+use Horde\Core\Service\TokenGrant;
 use RuntimeException;
 
 /**
@@ -23,4 +24,31 @@
  *
  * Callers should prompt the user to re-authorize.
  */
-class OAuthTokenRefreshException extends RuntimeException {}
+class OAuthTokenRefreshException extends RuntimeException
+{
+    public function __construct(
+        string $message,
+        private readonly string $userId,
+        private readonly string $providerId,
+        private readonly ?TokenGrant $grant = null,
+        int $code = 0,
+        ?\Throwable $previous = null
+    ) {
+        parent::__construct($message, $code, $previous);
+    }
+
+    public function userId(): string
+    {
+        return $this->userId;
+    }
+
+    public function providerId(): string
+    {
+        return $this->providerId;
+    }
+
+    public function grant(): ?TokenGrant
+    {
+        return $this->grant;
+    }
+}
diff --git a/src/Service/GrantStrategy.php b/src/Service/GrantStrategy.php
new file mode 100644
index 00000000..8c5ae703
--- /dev/null
+++ b/src/Service/GrantStrategy.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+enum GrantStrategy: string
+{
+    /**
+     * Extend an existing shared TokenGrant for this (userId, providerId).
+     * The new required scopes are added to the union.  The updated grant
+     * backs all ServiceAuthorizations for this provider.
+     */
+    case Additive = 'additive';
+
+    /**
+     * Create a new, independent TokenGrant carrying only the scopes
+     * required for this purpose.  No existing grant is modified.
+     * This is the default case.
+     */
+    case Isolated = 'isolated';
+}
diff --git a/src/Service/NullServiceAuthorizationRepository.php b/src/Service/NullServiceAuthorizationRepository.php
new file mode 100644
index 00000000..891b09d8
--- /dev/null
+++ b/src/Service/NullServiceAuthorizationRepository.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+/** Null ServiceAuthorizationRepository - safe default when service authorization is not configured. */
+class NullServiceAuthorizationRepository implements ServiceAuthorizationRepository
+{
+    public function find(
+        string $userId,
+        string $providerId,
+        ServicePurpose $purpose,
+    ): ?ServiceAuthorization {
+        return null;
+    }
+
+    public function findAll(string $userId, string $providerId): array
+    {
+        return [];
+    }
+
+    public function findAllForUser(string $userId): array
+    {
+        return [];
+    }
+
+    public function save(ServiceAuthorization $authorization): void {}
+
+    public function delete(ServiceAuthorization $authorization): void {}
+
+    public function deleteAll(string $userId, string $providerId): void {}
+}
diff --git a/src/Service/NullServiceAuthorizationService.php b/src/Service/NullServiceAuthorizationService.php
new file mode 100644
index 00000000..674ee08b
--- /dev/null
+++ b/src/Service/NullServiceAuthorizationService.php
@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+use Horde\OAuth\Client\OAuthFlowData;
+use Horde\OAuth\Client\ScopeSet;
+use Psr\Http\Message\UriInterface;
+
+/** Null ServiceAuthorizationService - safe default when service authorization is not configured. */
+class NullServiceAuthorizationService implements ServiceAuthorizationService
+{
+    public function get(
+        string $userId,
+        string $providerId,
+        ServicePurpose $purpose,
+    ): ServiceAuthorization {
+        throw new ServiceNotAuthorizedException(
+            $userId,
+            $providerId,
+            $purpose,
+            new ScopeSet()
+        );
+    }
+
+    public function initiate(
+        string $userId,
+        string $providerId,
+        ServicePurpose $purpose,
+        string $returnUrl,
+        ?string $requestingApp = null,
+    ): ?UriInterface {
+        return null;
+    }
+
+    public function handleCallback(string $code, OAuthFlowData $flowData): ServiceAuthorization
+    {
+        throw new \RuntimeException('Service authorization not configured');
+    }
+
+    public function revoke(
+        string $userId,
+        string $providerId,
+        ServicePurpose $purpose,
+    ): void {}
+
+    public function revokeAll(
+        string $userId,
+        string $providerId,
+        bool $revokeAtProvider = false,
+    ): void {}
+}
diff --git a/src/Service/NullTokenGrantRepository.php b/src/Service/NullTokenGrantRepository.php
new file mode 100644
index 00000000..da71e5b6
--- /dev/null
+++ b/src/Service/NullTokenGrantRepository.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+/** Null TokenGrantRepository - safe default when service authorization is not configured. */
+class NullTokenGrantRepository implements TokenGrantRepository
+{
+    public function findShared(string $userId, string $providerId): ?TokenGrant
+    {
+        return null;
+    }
+
+    public function findById(string $grantId): ?TokenGrant
+    {
+        return null;
+    }
+
+    public function findAll(string $userId, string $providerId): array
+    {
+        return [];
+    }
+
+    public function save(TokenGrant $grant): void {}
+
+    public function update(TokenGrant $grant): void {}
+
+    public function delete(TokenGrant $grant): void {}
+}
diff --git a/src/Service/OAuthProviderConfigRepository.php b/src/Service/OAuthProviderConfigRepository.php
index f1c0cd1d..4189e037 100644
--- a/src/Service/OAuthProviderConfigRepository.php
+++ b/src/Service/OAuthProviderConfigRepository.php
@@ -23,7 +23,7 @@
  * Storage contract for OAuth provider configurations.
  *
  * Providers are keyed by a unique slug (provider_id).
- * Data is returned as plain arrays with snake_case keys matching DB columns,
+ * Data is returned as plain arrays with snake_case keys matching DB columns
  * because the three provider types (oauth2, oidc, service_app) have
  * different shapes.
  *
diff --git a/src/Service/ServiceAuthorization.php b/src/Service/ServiceAuthorization.php
new file mode 100644
index 00000000..b4984609
--- /dev/null
+++ b/src/Service/ServiceAuthorization.php
@@ -0,0 +1,29 @@
+<?php
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+/**
+ * Revocation is performed through `ServiceAuthorizationService` rather than through this object.
+ * This avoids the object holding a self-reference to its repository.
+ */
+interface ServiceAuthorization
+{
+    public function userId(): string;
+    public function providerId(): string;
+    public function purpose(): ServicePurpose;
+    public function grant(): TokenGrant;
+
+    /**
+     * True if the backing grant is non-null and covers the scopes required
+     * for this purpose.  Does not perform a network call.
+     */
+    public function isSatisfied(): bool;
+
+    /**
+     * Return a valid access token delegating to grant()->getAccessToken().
+     *
+     * @throws ServiceNotAuthorizedException  when !isSatisfied()
+     * @throws OAuthTokenRefreshException     when the grant refresh fails
+     */
+    public function getAccessToken(): string;
+}
diff --git a/src/Service/ServiceAuthorizationRepository.php b/src/Service/ServiceAuthorizationRepository.php
new file mode 100644
index 00000000..4f3f943a
--- /dev/null
+++ b/src/Service/ServiceAuthorizationRepository.php
@@ -0,0 +1,26 @@
+<?php
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+interface ServiceAuthorizationRepository
+{
+    public function find(
+        string         $userId,
+        string         $providerId,
+        ServicePurpose $purpose,
+    ): ?ServiceAuthorization;
+
+    /** All authorizations for a (userId, providerId) pair. */
+    public function findAll(string $userId, string $providerId): array;
+
+    /** All authorizations for a user across all providers. */
+    public function findAllForUser(string $userId): array;
+
+    public function save(ServiceAuthorization $authorization): void;
+
+    public function delete(ServiceAuthorization $authorization): void;
+
+    /** Remove all authorizations for a (userId, providerId) pair. */
+    public function deleteAll(string $userId, string $providerId): void;
+}
diff --git a/src/Service/ServiceAuthorizationService.php b/src/Service/ServiceAuthorizationService.php
new file mode 100644
index 00000000..bb300c77
--- /dev/null
+++ b/src/Service/ServiceAuthorizationService.php
@@ -0,0 +1,74 @@
+<?php
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+use Psr\Http\Message\UriInterface;
+
+interface ServiceAuthorizationService
+{
+    /**
+     * Return an existing and satisfied ServiceAuthorization.
+     *
+     * @throws ServiceNotAuthorizedException  no authorization or grant does
+     *                                        not cover the required scopes.
+     *                                        The exception carries the purpose
+     *                                        and providerId. The caller can react by calling initiate().
+     */
+    public function get(
+        string         $userId,
+        string         $providerId,
+        ServicePurpose $purpose,
+    ): ServiceAuthorization;
+
+    /**
+     * Initiate an OAuth2 PKCE flow to establish a ServiceAuthorization.
+     *
+     * Additive strategy: if a shared grant already covers the required scopes,
+     * creates the ServiceAuthorization directly and returns null (no redirect).
+     *
+     * Isolated strategy: always starts a new flow. Preferred strategy.
+     *
+     * @throws UnsupportedPurposeException  the provider has no scope mapping
+     *                                      for this purpose.
+     * @return UriInterface|null  provider redirect URI, or null if no flow needed.
+     */
+    public function initiate(
+        string         $userId,
+        string         $providerId,
+        ServicePurpose $purpose,
+        string         $returnUrl,
+        ?string        $requestingApp = null,
+    ): ?UriInterface;
+
+    /**
+     * Handle the provider callback after PKCE state verification.
+     * Creates or updates the TokenGrant and creates the ServiceAuthorization.
+     * Does NOT call IdentityLinkService as that remains the caller's
+     * responsibility for 'login' and 'account_link' purposes.
+     */
+    public function handleCallback(string $code, OAuthFlowData $flowData): ServiceAuthorization;
+
+    /**
+     * Revoke a single ServiceAuthorization.
+     * The backing TokenGrant is not deleted.
+     */
+    public function revoke(
+        string         $userId,
+        string         $providerId,
+        ServicePurpose $purpose,
+    ): void;
+
+    /**
+     * Revoke all ServiceAuthorizations for a provider and delete all backing
+     * TokenGrants.
+     *
+     * @param bool $revokeAtProvider  True: Call the provider's revocation
+     *                                endpoint for each grant before deletion.
+     */
+    public function revokeAll(
+        string $userId,
+        string $providerId,
+        bool   $revokeAtProvider = false,
+    ): void;
+}
diff --git a/src/Service/ServiceNotAuthorizedException.php b/src/Service/ServiceNotAuthorizedException.php
new file mode 100644
index 00000000..c4ad3a69
--- /dev/null
+++ b/src/Service/ServiceNotAuthorizedException.php
@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+use Horde\OAuth\Client\ScopeSet;
+
+final class ServiceNotAuthorizedException extends \RuntimeException
+{
+    public function __construct(
+        private readonly string $userId,
+        private readonly string $providerId,
+        private readonly ServicePurpose $purpose,
+        private readonly ScopeSet $missingScopes,
+        string $message = '',
+        int $code = 0,
+        ?\Throwable $previous = null
+    ) {
+        if ($message === '') {
+            $message = sprintf(
+                "User '%s' is not authorized for purpose '%s' on provider '%s'",
+                $userId,
+                $purpose->identifier(),
+                $providerId
+            );
+        }
+        parent::__construct($message, $code, $previous);
+    }
+
+    public function userId(): string
+    {
+        return $this->userId;
+    }
+
+    public function providerId(): string
+    {
+        return $this->providerId;
+    }
+
+    public function purpose(): ServicePurpose
+    {
+        return $this->purpose;
+    }
+
+    /** Scopes still needed; empty ScopeSet if no grant exists at all. */
+    public function missingScopes(): ScopeSet
+    {
+        return $this->missingScopes;
+    }
+}
diff --git a/src/Service/ServicePurpose.php b/src/Service/ServicePurpose.php
new file mode 100644
index 00000000..006aa196
--- /dev/null
+++ b/src/Service/ServicePurpose.php
@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+/**
+ * Represents a specific purpose for which a service is used
+ * This is Horde Apps vocabulary decoupled from specific scopes an IdP provider may use to model the same concept.
+ * I.e. if the Horde identifier is "mail" and the scope in one IdP is "email" and the scope in another IdP is "imap", the ServicePurpose identifier is "mail"
+ * Two service purposes are equal if they have the same identifier even if they have different GrantStrategies.
+ * The default strategy is isolated grants.
+ */
+final class ServicePurpose
+{
+    private function __construct(
+        private readonly string        $identifier,
+        private readonly GrantStrategy $grantStrategy = GrantStrategy::Isolated,
+    ) {}
+
+    public static function of(string $identifier, GrantStrategy $grantStrategy = GrantStrategy::Isolated): self
+    {
+        return new self($identifier, $grantStrategy);
+    }
+
+    public function identifier(): string
+    {
+        return $this->identifier;
+    }
+
+    public function grantStrategy(): GrantStrategy
+    {
+        return $this->grantStrategy;
+    }
+
+    public function equals(self $other): bool
+    {
+        return $this->identifier === $other->identifier;
+    }
+
+    /** Round-trip through OAuthFlowData persistence. */
+    public function serialize(): array
+    {
+        return ['id' => $this->identifier, 'strategy' => $this->grantStrategy->value];
+    }
+
+    public static function deserialize(array $data): self
+    {
+        return new self($data['id'], GrantStrategy::from($data['strategy']));
+    }
+}
diff --git a/src/Service/TokenGrant.php b/src/Service/TokenGrant.php
new file mode 100644
index 00000000..3d1558fe
--- /dev/null
+++ b/src/Service/TokenGrant.php
@@ -0,0 +1,36 @@
+<?php
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+interface TokenGrant
+{
+    /** Stable UUID assigned at creation; used as FK by ServiceAuthorization. */
+    public function grantId(): string;
+
+    public function userId(): string;
+    public function providerId(): string;
+
+    /** The set of OAuth scopes that were granted by the provider. */
+    public function grantedScopes(): ScopeSet;
+
+    /**
+     * Return true if grantedScopes() is a superset of $required.
+     * Does not perform a network call.
+     */
+    public function covers(ScopeSet $required): bool;
+
+    /**
+     * Return a valid access token string.
+     * Refresh transparently if expired.
+     * Persists the refreshed TokenSet via TokenGrantRepository.
+     *
+     * @throws OAuthTokenRefreshException
+     */
+    public function getAccessToken(): string;
+
+    public function isExpired(): bool;
+
+    /** Raw token data */
+    public function tokenSet(): TokenSet;
+}
diff --git a/src/Service/TokenGrantRepository.php b/src/Service/TokenGrantRepository.php
new file mode 100644
index 00000000..26b01525
--- /dev/null
+++ b/src/Service/TokenGrantRepository.php
@@ -0,0 +1,32 @@
+<?php
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+interface TokenGrantRepository
+{
+    /**
+     * Find the shared grant for a "GrantStrategy::Additive" strategy lookup.
+     * Returns the single grant that is not exclusively owned by an Isolated
+     * ServiceAuthorization or null if none exists.
+     */
+    public function findShared(string $userId, string $providerId): ?TokenGrant;
+
+    /** Find any grant by its stable UUID. */
+    public function findById(string $grantId): ?TokenGrant;
+
+    /** Find all grants for a (userId, providerId) pair. */
+    public function findAll(string $userId, string $providerId): array;
+
+    /** Persist a new TokenGrant. */
+    public function save(TokenGrant $grant): void;
+
+    /**
+     * Persist changes to an existing grant (e.g. refreshed access token or
+     * extended scope set after an Additive flow).
+     */
+    public function update(TokenGrant $grant): void;
+
+    /** Delete a grant row. Caller must ensure no ServiceAuthorization references it. */
+    public function delete(TokenGrant $grant): void;
+}
diff --git a/src/Service/UnsupportedPurposeException.php b/src/Service/UnsupportedPurposeException.php
new file mode 100644
index 00000000..091be953
--- /dev/null
+++ b/src/Service/UnsupportedPurposeException.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Horde\Core\Service;
+
+final class UnsupportedPurposeException extends \RuntimeException
+{
+    public function __construct(
+        private readonly string $providerId,
+        private readonly ServicePurpose $purpose,
+        string $message = '',
+        int $code = 0,
+        ?\Throwable $previous = null
+    ) {
+        if ($message === '') {
+            $message = sprintf(
+                "Provider '%s' does not support purpose '%s'",
+                $providerId,
+                $purpose->identifier()
+            );
+        }
+        parent::__construct($message, $code, $previous);
+    }
+
+    public function providerId(): string
+    {
+        return $this->providerId;
+    }
+
+    public function purpose(): ServicePurpose
+    {
+        return $this->purpose;
+    }
+}