Hello @mkochco welcome to the community!
I’d need to test your code to see if I can reproduce the error, but first wanted to clarify the need for permissions in the scope claim. Is there a particular reason you are going this route as opposed to just utilizing the permissions claim through RBAC?
Let us know!