Function verify_requested_scope_is_subset 

pub fn verify_requested_scope_is_subset(
    requested: &Scopes,
    allowed: &Scopes,
) -> Result<(), OIDCError>

Every requested scope must be within what the client is configured to request. The configured scopes are a ceiling, not a list of exact strings: patient/*.rs lets a client request patient/Medication.rs, and patient/Medication.rs lets it request patient/Medication.s (see [Scopes::covers_scope]).