Hello @mowolf! Some users have been experiencing issues with Rules not being called: Rules are not being called - #23 by c.kapplmueller. Looking at your code (which looks good), it seems that this may be your issue. We’re working hard to resolve it!
Regarding scopes, please remove groups from scopes. To learn more about scopes and their usage, please check out this blog article: On The Nature of OAuth2’s Scopes