@Dan50, I do want to mention one clarification. Currently, when you authenticate to an Asana account per our discussion above, you gain access to ALL workspaces/organizations that account has access to.
One thing Asana is doing to reduce that scope is that, in the future, instead of authenticating to an entire Asana account, the user in granting access will be able to select ONE workspace/organization that they have access to, and your app will only be granted access to that one space. You still have access to everything within that space, but at least users who are members of multiple spaces will be able to grant app access to just one of them.