Identity Basics

Scopes, permissions, and tokens

How a permission becomes a scope your app can check
Report issue

Covers how the roles assigned to a user turn into scopes on an access token, and how a service should check them at the endpoint level rather than infer authorization from identity alone.