It could be useful to add OAuth2 scopes for managing authorization for the REST API.
I don't know if this would be possible without having Koha have an OAuth2 authorization server...