return blank permissions if no scope is given