The list of permissions a scope grants are whitelisted, so that when new permissions are added we don't automatically grant it to all scopes.