Authentication schemes define scopes that govern the permissions that an authenticated client has when accessing the service.

A service may support multiple different schemes for authentication.

This is well supported today in our authentication vocabulary.

However, access to an individual resource today is specified through a PermissionType, which specifies a set of scopes from a single authentication scheme. If the service supports multiple authentication schemes, then any of the supported authentication schemes may control access to the resource.

Where controlling access to a resource, the capabilities vocabulary should specify a collection of PermissionTypes (required scopes from a particular authentication scheme) that can be used to access a resource.