In my understanding of OAuth2 the scope may be used to specify access to what is asked and granted by code owner.
In most cases I encounters the scope list is closed and specify "kinds" of thing that can be accessed, for example profile, email, openid from Google Sign-in.
Does it make sense to encode access to specific resources in scope? Like account:{account number}:rw
This is for the case where user have multiple distinct resources managed by resource server and would like to authorize third party access to specific resources but instead of "kind" of resource. For example the hypothetical application would manage data folders and user U would grant read access to his folder "/A" but not any other folder to application B
I understand that in such case both Authorization and Resource server would have to parse and specifically handle such open ended scopes.
Are there other issues with that approach?
Is OAuth2 even right technology for such case? If not what to use instead?