Caller's permissions on DID assignments for their active tenant. The FE keys the
"Manage" / scope-edit UI off these flags so it doesn't have to second-guess JWT
roles or user shapes — authoritative answer comes from the connector.
{
"canManageScope": true
}