just to confirm. If we have multi tenant and the ability for users to define their own policies. Using

scopes

is the correct way to handle this?

Yes, that’s correct.