custom resource scope, add scope assert_valid_keys