OAuth scopes are not object permissions

An OAuth scope like files:read says the token may call read endpoints. It does not say this token may read this file.

Scopes bound actions at the API surface. Resource authorization answers a different question: may this caller act on this object, right now?

Check both. Grant the least scopes you need, and still enforce ownership or relationship checks on every object id the request touches.