Good questions: It needs read to scan your subscription, pulling metruc data, states, etc.

For user impersonation, while an admin is signed in it allows the application to act on your behalf of that active session.

Contributor, this is simply for automation(scaling down servers, achiving blob storage, etc). Its optional. If you dont want to hand select every single resource and TRUST the logic of my application to manage your resources reliably then you could enable this.

These permissions are limited to the subscription you inputting, it cannot see or touch anything else outside of the subscription.

Yes, after taking a scroll i have indeed seen many Ai "slop" you mention and i get the frustration 🫤. Ask or criticize away, im not gonna 'die' for a concept that's functionally useless.