How to configure user API permissions

Help
,
1

Hello,
I created an API in the dashboard with two permissions read:photo and write:photo.
Now any user token against the api audience url, it has by default all the scopes (read:photo and write:photo), though the user is not assigned any permissions (in the users section), how can i configure the default permissions per user.

Please also find my sample authentication request body for a specific user:

grant_type=password&audience=api_url&username=username&password=pass&client_id=myClientId&client_secret=myClientSecret&scope=offline_access
2

Hi,
You could implement access policies through rules. You would need to check the app_metadata for the user during token issuance and include only the scopes that match the policy defined there