The list of scopes that are defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.