Function scope_permits 

pub fn scope_permits(scope: Option<&str>, method: &Method, path: &str) -> bool

Whether a credential carrying scope may perform method on path.

Fails closed: an unrecognised scope string grants nothing, anywhere. Tenant API keys are minted with the full tenant-owner role set regardless of their scopes column, so “unrecognised” must never degrade to “unrestricted”.

None means an unscoped credential — unrestricted here, gated by roles/ABAC instead. validate_api_key normalises a blank scopes column to None; a blank string arriving anyway is a capability list with no capabilities, and grants nothing.