Add Authorization scope check and specs