Working with Laravel Passport scopes: typical workflow

Perhaps such an obvious question, but requesting an access token with Password Grant Type and 'scope' => '*', using Laravel 5.3 + Passport always returns the all-access token, no matter the user who requested it.

So... Where does the filtering / limiting validation logic usually reside? Can you please specify the common workflow in this situations?

from Newest questions tagged laravel-5 - Stack Overflow http://ift.tt/2heFrfN
via IFTTT