How do OAuth scopes work with the coaz model?

[tulshi]

From @maxwellgerber:
Oh, how do classic OAuth scopes work in this model? If a user wants to give client A read write access and client B read access, how does that get encoded into the SARC representation? Is that still evaluated by the PDP?

[vatsalgupta]

I believe we should keep them separate. OAuth should own coarse-grained session/scope checks and COAZ owns fine-grained per-invocation checks. PEP should check if the operation is allowed based on oAuth token (like can agent use this tool at all). If yes, then create a COAZ request to check if fine grained operation is supported.