OAuth scopes are not your app's authorization model

OAuth scopes answer: "what APIs may this token call?"

They do not answer: "may this user read this document?"

A token with documents:read can still be used against every document ID the holder can guess, unless your API binds subject + action + resource on every request.

Treat scopes as a coarse gate on the credential. Keep resource-level authorization inside your app — RBAC/ReBAC/ABAC checks that use the authenticated subject from the token, not a client-supplied owner id.

Same idea for "the JWT is valid": authentication succeeded. Authorization is a separate decision.