diff --git a/accounts/pkg/storage/cs3.go b/accounts/pkg/storage/cs3.go
index e43d24655..6d2aef584 100644
--- a/accounts/pkg/storage/cs3.go
+++ b/accounts/pkg/storage/cs3.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"github.com/cs3org/reva/pkg/auth/scope"
 	"io"
 	"io/ioutil"
 	"net/http"
@@ -312,7 +313,11 @@ func AuthenticateCS3(ctx context.Context, su config.ServiceUser, tm token.Manage
 			},
 		},
 	}
-	return tm.MintToken(ctx, u)
+	s, err := scope.GetOwnerScope()
+	if err != nil {
+		return
+	}
+	return tm.MintToken(ctx, u, s)
 }
 
 func (r CS3Repo) accountURL(id string) string {
diff --git a/ocis-pkg/middleware/account.go b/ocis-pkg/middleware/account.go
index 1e8211a1a..ee96d7657 100644
--- a/ocis-pkg/middleware/account.go
+++ b/ocis-pkg/middleware/account.go
@@ -3,6 +3,7 @@ package middleware
 import (
 	"context"
 	"encoding/json"
+	"github.com/cs3org/reva/pkg/auth/scope"
 	"net/http"
 
 	"github.com/asim/go-micro/v3/metadata"
@@ -53,11 +54,15 @@ func ExtractAccountUUID(opts ...account.Option) func(http.Handler) http.Handler
 				return
 			}
 
-			u, err := tokenManager.DismantleToken(r.Context(), token)
+			u, tokenScope, err := tokenManager.DismantleToken(r.Context(), token)
 			if err != nil {
 				opt.Logger.Error().Err(err)
 				return
 			}
+			if ok, err := scope.VerifyScope(tokenScope, r); err != nil || !ok {
+				opt.Logger.Error().Err(err).Msg("verifying scope failed")
+				return
+			}
 
 			// store user in context for request
 			ctx := user.ContextSetUser(r.Context(), u)
diff --git a/ocis/go.mod b/ocis/go.mod
index 2f97be81b..b31efbd5b 100644
--- a/ocis/go.mod
+++ b/ocis/go.mod
@@ -8,9 +8,11 @@ require (
 	contrib.go.opencensus.io/exporter/zipkin v0.1.2
 	github.com/asim/go-micro/plugins/logger/zerolog/v3 v3.0.0-20210217182006-0f0ace1a44a9
 	github.com/asim/go-micro/v3 v3.5.1-0.20210217182006-0f0ace1a44a9
+	github.com/cznic/b v0.0.0-20181122101859-a26611c4d92d // indirect
 	github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00 // indirect
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/imdario/mergo v0.3.11 // indirect
+	github.com/jmhodges/levigo v1.0.0 // indirect
 	github.com/micro/cli/v2 v2.1.2
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
 	github.com/olekukonko/tablewriter v0.0.5
@@ -33,6 +35,7 @@ require (
 	github.com/rs/zerolog v1.21.0
 	github.com/spf13/cobra v1.1.3
 	github.com/spf13/viper v1.7.1
+	github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c // indirect
 	github.com/thejerf/suture/v4 v4.0.0
 	go.opencensus.io v0.23.0
 	honnef.co/go/tools v0.0.1-2020.1.5 // indirect
diff --git a/ocs/pkg/server/http/svc_test.go b/ocs/pkg/server/http/svc_test.go
index 8e2cf2d42..ff04f7f8a 100644
--- a/ocs/pkg/server/http/svc_test.go
+++ b/ocs/pkg/server/http/svc_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/asim/go-micro/v3/client"
 	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
+	"github.com/cs3org/reva/pkg/auth/scope"
 	"github.com/cs3org/reva/pkg/token"
 	"github.com/cs3org/reva/pkg/token/manager/jwt"
 	"github.com/golang/protobuf/ptypes/empty"
@@ -660,7 +661,8 @@ func mintToken(ctx context.Context, su *User, roleIds []string) (token string, e
 			},
 		},
 	}
-	return tokenManager.MintToken(ctx, u)
+	s, _ := scope.GetOwnerScope()
+	return tokenManager.MintToken(ctx, u, s)
 }
 
 func sendRequest(method, endpoint, body string, u *User, roleIds []string) (*httptest.ResponseRecorder, error) {
diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go
index 298e62015..f8f7e5024 100644
--- a/ocs/pkg/service/v0/users.go
+++ b/ocs/pkg/service/v0/users.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
+	"github.com/cs3org/reva/pkg/auth/scope"
 	"net/http"
 	"strconv"
 	"strings"
@@ -507,7 +508,11 @@ func (o Ocs) mintTokenForUser(ctx context.Context, account *accounts.Account) (s
 			},
 		},
 	}
-	return tm.MintToken(ctx, u)
+	s, err := scope.GetOwnerScope()
+	if err != nil {
+		return "", err
+	}
+	return tm.MintToken(ctx, u, s)
 }
 
 // EnableUser enables a user
diff --git a/proxy/pkg/middleware/account_resolver.go b/proxy/pkg/middleware/account_resolver.go
index b8379564f..c9e5819fc 100644
--- a/proxy/pkg/middleware/account_resolver.go
+++ b/proxy/pkg/middleware/account_resolver.go
@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"github.com/cs3org/reva/pkg/auth/scope"
 	"github.com/owncloud/ocis/proxy/pkg/user/backend"
 	"net/http"
 
@@ -91,8 +92,12 @@ func (m accountResolver) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		m.logger.Debug().Interface("claims", claims).Interface("user", u).Msgf("associated claims with uuid")
 	}
 
-	token, err := m.tokenManager.MintToken(req.Context(), u)
-
+	s, err := scope.GetOwnerScope()
+	if err != nil {
+		m.logger.Error().Err(err).Msgf("could not get owner scope")
+		return
+	}
+	token, err := m.tokenManager.MintToken(req.Context(), u, s)
 	if err != nil {
 		m.logger.Error().Err(err).Msgf("could not mint token")
 		w.WriteHeader(http.StatusInternalServerError)