docs: private Set<String> checkUserScopes(Set<String> requestedScopes,
                                          Collection<? extends GrantedAuthority> authorities,
                                          ClientDetails clientDetails) {
          Set<String> allowed = new LinkedHashSet<>(AuthorityUtils.authorityListToSet(authorities));
          // Add in all default requestedScopes
          Collection<String> defaultScopes = IdentityZoneHolder.get().getConfig().getUserConfig().getDefaultGroups();
          allowed.addAll(defaultScopes);
  
          // Find intersection of user authorities, default requestedScopes and client requestedScopes:
          Set<String> result = intersectScopes(new LinkedHashSet<>(requestedScopes), clientDetails.getScope(), allowed);
  
          // Check that a token with empty scope is not going to be granted
          if (result.isEmpty() && !clientDetails.getScope().isEmpty()) {
              logger.warn("The requested scopes are invalid");
              throw new InvalidScopeException(requestedScopes + " is invalid. This user is not allowed any of the requested scopes");
          }
  
          Collection<String> requiredUserGroups = ofNullable((Collection<String>) clientDetails.getAdditionalInformation().get(REQUIRED_USER_GROUPS)).orElse(emptySet());
          if (!UaaTokenUtils.hasRequiredUserAuthorities(requiredUserGroups, authorities)) {
              logger.warn("The requested scopes are invalid");
              throw new InvalidScopeException("User does not meet the client's required group criteria.");
          }
  
          return result;
      }