authorization scope determination based on user permission