I dont't like that `create()` is more permissive than `create(scope)`. In my opinion permission checks should not have optional parameters.