public static OAuthBearerValidationResult validateScope(OAuthBearerToken token, List<String> requiredScope) {
        final Set<String> tokenScope = token.scope();
        if (requiredScope == null || requiredScope.isEmpty())
            return OAuthBearerValidationResult.newSuccess();
        for (String requiredScopeElement : requiredScope) {
            if (!tokenScope.contains(requiredScopeElement))
                return OAuthBearerValidationResult.newFailure(String.format(
                        "The provided scope (%s) was missing a required scope (%s).  All required scope elements: %s",
                        tokenScope, requiredScopeElement, requiredScope),
                        requiredScope.toString(), null);
        }
        return OAuthBearerValidationResult.newSuccess();
    }
Validate the given token's scope against the required scope. Every required
scope element (if any) must exist in the provided token's scope for the
validation to succeed.

@param token
           the required token for which the scope will to validate
@param requiredScope
           the optional required scope against which the given token's scope
           will be validated
@return the result of the validation
clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/unsecured/OAuthBearerValidationUtils.java