OTOH, the set of possible scopes will grow over time. Dunno if that makes managing a bitmask difficult (or increases the probability of bugs where the bit-assignments get confused). String-in-DB sounds good to me. Github uses comma-joined strings, Google uses space-joined strings. Not sure which to use.