OAuth scopes are not your app's authorization model

OAuth scopes answer: "what APIs may this token call?" They do not answer: "may this user read this...