When granting an access token, its scope should honor the scope specified in the request instead of the stored default scope