code: func AllowsArbitraryScopes(ctx context.Context, opts Options) bool {
  	if opts.Method == AutoSelectMethod {
  		opts.Method = SelectBestMethod(ctx, opts)
  	}
  	switch {
  	case opts.Method == ServiceAccountMethod:
  		// A private key can be used to generate tokens with any combination of
  		// scopes.
  		return true
  	case opts.Method == LUCIContextMethod:
  		// We can ask the local auth server for any combination of scopes.
  		return true
  	case opts.ActAsServiceAccount != "":
  		// When using IAM-derived tokens authenticator relies on singBytes IAM RPC.
  		// It is similar to having a private key, and also can be used to generate
  		// tokens with any combination of scopes
  		return true
  	}
  	return false
  }
docs: // AllowsArbitraryScopes returns true if given authenticator options allow
  // generating tokens for arbitrary set of scopes.
  //
  // For example, using a private key to sign assertions allows to mint tokens
  // for any set of scopes (since there's no restriction on what scopes we can
  // put into JWT to be signed).
  //
  // On other hand, using e.g GCE metadata server restricts us to use only scopes
  // assigned to GCE instance when it was created.