MediaWiki borrowed the concept of "grant" (bundle of permissions you can grant to an application to use on your behalf) from OAuth 1. OAuth 1 is largely extinct now, and OAuth 2 unhelpfully renamed the concept to "scope". We should probably bite the bullet and rename things:

• the $wgGrantPermissions / $wgGrantPermissionGroups / $wgGrantRiskGroups configuration variables (needs B/C)
• the GrantPermissions / GrantPermissionGroups / GrantRiskGroups fields in extension.json (needs B/C)
• the GrantsInfo and GrantsLocalization classes / services and many of their methods
• the ListGrants special page
• the bot password UI, form handler, the BotPassword::getGrants() method, and some of the options / code of createBotPassword.php
• maybe the bp_grants DB field (might not be worth it)
• maybe a ton of message keys (might not be worth it)
• a bunch of documentation (Manual:Grants, Manual:Bot_passwords, Manual:Bot_passwords_table...)