oauth2 permissions are not agile at all. there is no 'one time token' for some action or 'allow it for 1 day only'. If you allowed 'wall' - it's forever.
Yes, but at the first point where the user performed an action relevant to their desires, you have requested the associated permission. The connection is clear in their mind and the app's request for that permission makes sense.
