Drive-SDK Devs, thought you would be the best to ask. Looking at Slack - Google drive integration for example, it is asking to give permission to following:
Questions is about the hierarchy of this capability based security levels:
Does this mean that Slack has view access to all google drive files and manage to those opened/created by Slack
or is (4) prevailing in which case (1) is superfluous?
The two are additive to the ACL. So Slack has full r/w rights to any files which are created/opened by it. Any files which have not been created/opened by Slack are able to be read by Slack, but may not be changed/deleted.