I read so much in order to understand a few things and you confirmed my theories. - https://www.ory.sh/oauth2-openid-connect-do-you-need-use-cases-examples/#scopes-are-not-permissions - https://authzed.com/blog/identity-isnt-the-foundation#groups-scopes-claims-dont-answer-the-question