title: Keycloak authorization services don't deny scopes in resource
body: <p>I am testing Keycloak authorization services in the admin console and I'm unable to understand why in the next example keycloak is authorizing a user (tested in the <code>evaluate</code> tab). this is my setup :</p>
  
  <ul>
  <li>Created a realm <code>test</code></li>
  <li>Created a client <code>democlient</code> with <code>Authorization Enabled</code> on</li>
  <li>Create the realm role <code>Admin</code></li>
  <li>Create the user <code>adminuser</code> and assign it to the <code>Admin</code> role</li>
  </ul>
  
  <hr>
  
  <p>In the <code>Authorization</code> tab withing the client <code>democlient</code>:</p>
  
  <ul>
  <li>In <code>Settings</code> -> <code>Policy Enforcement Mode</code> is set to <code>Enforcing</code></li>
  <li>Create 2 scopes: <code>list</code> and <code>save</code></li>
  <li>Create a resource <code>Resource A</code> with the 2 previous scopes</li>
  <li>In <code>Policies</code> tab, create a new <code>Role policy</code> called <strong>Only admins</strong> where (of course) i only permit admins:
  <a href="https://i.stack.imgur.com/zVnUj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zVnUj.png" alt="creation of role policy"></a></li>
  <li>In <code>Permissions</code> tab, created a <code>Scoped-based</code> permission called <strong>permit only admins Resource A, list Scope</strong>:
  <a href="https://i.stack.imgur.com/EJ5YB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EJ5YB.png" alt="Creation of permission where only an admin can access the Resource A and Scope list"></a></li>
  </ul>
  
  <p>And that's it. now i check in the <code>evaluate</code> tab this policy using the adminuser, role Admin, Resource A, Scope List:</p>
  
  <p><a href="https://i.stack.imgur.com/7GeIT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7GeIT.png" alt="Keycloak Authorizing the rule"></a></p>
  
  <p>success! everything is fine in the world!... except <strong>No</strong>. 
  checking again the policy with the adminuser, role Admin, Resource A, <strong>Scope save</strong> (a scope where I did not define any permission) Keycloak is again Authorizing this rule :/</p>
  
  <p>i assumed that <code>policy enforcement mode</code> set to <code>Enforcing</code> will deny the access to scope save, from the documentation of keycloak:</p>
  
  <blockquote>
    <p>The policy enforcement mode dictates how policies are enforced when evaluating authorization requests. 'Enforcing' means requests are denied by default even when there is no policy associated with a given resource. 'Permissive' means requests are allowed even when there is no policy associated with a given resource. 'Disabled' completely disables the evaluation of policies and allows access to any resource.</p>
  </blockquote>
  
  <p>so... what i am doing wrong? how can i make that keycloak deny the access to the <code>save scope</code>? (obviously i can make a permission where i explicitly deny this scope. but i want that the default is deny as the documentation says)
  Any ideas will be deeply appreciated.</p>