code: func verifyScopes(scopeString string, username string, clientID string, orgMgr *organization.Manager) (string, error) {
  	scopes := strings.Split(scopeString, ",")
  	for i, scope := range scopes {
  		// If the scope is memberof:clientid, where clientid is the globalid of the
  		// organization requesting authorization, verify if we really have this scope
  		// or if we have the scope on one or more children. In case of the latter, replace
  		// the scopes by the appropriate ones
  		if scope == "user:memberof:"+clientID {
  			inOrg, err := orgMgr.IsInOrgs(username, clientID)
  			if err != nil {
  				return scopeString, err
  			}
  			// Should only have 1 result, and result MUST be clientID
  			if len(inOrg) == 1 && inOrg[0] == clientID {
  				return scopeString, nil
  			}
  
  			log.Debugf("Access token contains scope %v, but user is not a member of %v - parse suborganizations",
  				scope, clientID)
  			// Remove the memberof:parentOrg scope
  			scopes = append(scopes[:i], scopes[i+1:]...)
  			var subOrgScopes []string
  			subOrgScopes, err = findSuborgScopes(clientID, username, orgMgr)
  			if err != nil {
  				return scope, err
  			}
  			// Add the correct memberof scopes
  			scopes = append(scopes, subOrgScopes...)
  			scopeString = strings.Join(scopes, ",")
  		}
  	}
  	return scopeString, nil
  }
docs: // verifyScopes checks for a user:memberof:clientid scope. If present, check if the user
  // really is a member or owner in this organization. Should this not be the case,
  // remove the scope and add the correct memberof:childorg scopes