title: OAuth 2 Server Associating Scopes with Users?
body: <p>When building an OAuth 2 server, is there anything wrong with associating scopes to users? Essentially allowing scopes to act as your applications roles?</p>
  <p>I've looked at the <a href="https://www.rfc-editor.org/rfc/rfc6749#section-3.3" rel="nofollow noreferrer">RFC</a> but can't seem to find any guidance on this.</p>
  <p>The use case for a flow would be something like this:</p>
  <pre><code>                   A client requests an access token.
                                    |
                                    ↓
               On the server side: it checks to see if the user 
                   is able to receive the requested scope(s). 
                         ⁄                              \
                       ↙                                 ↘
                 Check Passes:                       Check Fails:
                       |                                 |
                       ↓                                 ↓
             Server issues token.           Server denies request for token.
  </code></pre>
  <p><strong>Some more visual context</strong>, this is a SQL data representation:</p>
  <p><img src="https://i.stack.imgur.com/wssdz.png" alt="enter image description here" /></p>