I am also in favor of allowing the developer to pass the assertion explicitly, but...
```php
$authorization->isGranted('permission', null, $scope); // It looks a bit ugly, no?
```

There are other (ugly) ways to handle that:
```php
// Hard to implement?
$authorization->isGranted('permission', $scopeOrAssertion);

// Rely on array structure? Not very nice.
$authorization->isGranted(['permission', 'assertion'], $scope);

// Assertion as third param, why pass $scope before $aasertion? =/
$authorization->isGranted('permission', $scope, $assertion);
```

I have no opinion on what is the best approach, but I'd like to keep this feature.