Each item's quantity can be positive (increase) or negative (decrease); the actual permission check happens server-side based on its sign, which OpenAPI can't express conditionally, so this caller needs at least one of the two scopes below, not both.