I was thinking about this. A bitmask requires that the oauth server keep a list of all possible scopes. If attached services can define new scopes, we can't keep track of them all.