I want to use Okta for authorization and authentication. I will create an Authorization Server which will authenticate people through an IDP.

From what I've read, the authorization server can have custom scopes and scopes are supposed to be the permissions and what something can do.

My question is if a scope can be assigned for a specific user or a group - for example, if I create a scope "can delete from db", can I tell the authorization server to issue me a token for a specific group with that scope and for another group a token without that scope?

I'm not even sure if a scope is something that is passed in the token and my service can read the scopes from the token and then decide if to allow the action the user is attempting, or if it works in a different way completely?