permissions are regularly included in scopes and you should be driving access based on permissions, not roles, roles are just a bucket for permissions.