RBAC and User-delegated Access Behavior

When you’ve already set up everything (see yesterday’s journal), you should see permissions like read:messages in permissions and scope claims in the access_token from /oauth/token. However, there are some nuances that you need to know:

1. permissions will have the permissions assigned to the authenticated user as long as Add Permissions in the Access Token is enabled. These are the permissions assigned to the user.
2. scope changes because the final value is the intersection of the requested scope by the client, User-delegated Access permissions assigned to the SPA, and the assigned permissions to the user. For example, even if read:messages is assigned to the user, the scope from the access_token will not contain that permission if any of the two does not have the requested permission: User-delegated Access of the SPA and user’s permissions.