In order to limit broker auth keys to a minimal set of permissions (just what they need), the application/:id/build scope grants access to :create_builder_application instead of :create_application.  That limits the types of app that can be created to only those that have a single framework cartridge, and share the same domain as the scope's domain.