OAuth scopes have been part of authorization systems for years, and almost every identity provider manages them as independent objects.
For small applications, this approach works perfectly.
However, after working on enterprise applications and identity systems for many years, I kept encountering the same problem: as the number of APIs, OAuth clients, and permissions grows, maintaining OAuth configuration gradually becomes more difficult than implementing the authorization logic itself.
This made me wonder:
Should OAuth scopes really be managed manually, or are they simply another artifact that can be generated from the authorization model?
