Oauth scopes vs record permissions

Maybe tie oauth scopes to lexicon NSID’s?