check_route_scopes now runs identically across JWT, service-account, and MCP paths, and a data-driven get_resource_context_from_path replaces the old hardcoded substring matching. Access control behaves consistently no matter how a request arrives, so a scope you set means the same thing everywhere.
View the RBAC Custom Scope Mappings docs to learn more.