Furthermore, a client can omit scope and leave it up to the server to decide whether to fall back to a default scope or fail the oauth request.