diff --git a/TS26510_Maf_Provisioning_ConsumptionReporting.yaml b/TS26510_Maf_Provisioning_ConsumptionReporting.yaml
index ba17196677d165363e8c0f42b81e6aec35a6a8a9..6d1ed2e0162a39ba539318c3716c346487bd366c 100644
--- a/TS26510_Maf_Provisioning_ConsumptionReporting.yaml
+++ b/TS26510_Maf_Provisioning_ConsumptionReporting.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: activateConsumptionReporting
       summary: 'Activate the consumption reporting procedure for the specified Provisioning Session by providing the Consumption Reporting Configuration'
+      security:
+        - OAuth2ClientCredentials:
+          - consumption-reporting-create
       requestBody:
         description: 'A JSON representation of a Consumption Reporting Configuration'
         required: true
@@ -79,6 +82,9 @@ paths:
     get:
       operationId: retrieveConsumptionReportingConfiguration
       summary: 'Retrieve the Consumption Reporting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - consumption-reporting-read
       responses:
         '200': # OK
           description: 'Success'
@@ -107,6 +113,9 @@ paths:
     put:
       operationId: updateConsumptionReportingConfiguration
       summary: 'Update the Consumption Reporting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - consumption-reporting-put
       requestBody:
         description: 'A JSON representation of a Consumption Reporting Configuration'
         required: true
@@ -150,6 +159,9 @@ paths:
     patch:
       operationId: patchConsumptionReportingConfiguration
       summary: 'Patch the Consumption Reporting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - consumption-reporting-patch
       requestBody:
         description: 'A JSON representation of a Consumption Reporting Configuration'
         required: true
@@ -196,6 +208,9 @@ paths:
     delete:
       operationId: destroyConsumptionReportingConfiguration
       summary: 'Destroy the current Consumption Reporting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - consumption-reporting-delete
       responses:
         '204': # No Content
           description: 'Consumption Reporting Configuration Destroyed'
@@ -225,7 +240,12 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes:
+            consumption-reporting-create: Create consumption reporting
+            consumption-reporting-read: Read consumption reporting
+            consumption-reporting-put: Put consumption reporting
+            consumption-reporting-patch: Patch consumption reporting
+            consumption-reporting-delete: Delete consumption reporting
 
   schemas:
     ConsumptionReportingConfiguration:
diff --git a/TS26510_Maf_Provisioning_ContentHosting.yaml b/TS26510_Maf_Provisioning_ContentHosting.yaml
index d33a71607d0137f20de172ee1f8b947d99fa4141..10c04a07a40a7009ba5d3f179311f77621fda1b1 100644
--- a/TS26510_Maf_Provisioning_ContentHosting.yaml
+++ b/TS26510_Maf_Provisioning_ContentHosting.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: createContentHostingConfiguration
       summary: 'Create and upload the Content Hosting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-hosting-configuration-create
       requestBody:
         description: 'A JSON representation of a Content Hosting Configuration'
         required: true
@@ -81,6 +84,9 @@ paths:
     get:
       operationId: retrieveContentHostingConfiguration
       summary: 'Retrieve the Content Hosting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-hosting-configuration-read
       responses:
         '200': # OK
           description: 'Success'
@@ -109,6 +115,9 @@ paths:
     put:
       operationId: updateContentHostingConfiguration
       summary: 'Update (by replacement) the Content Hosting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-hosting-configuration-put
       requestBody:
         description: 'A JSON representation of a Content Hosting Configuration'
         required: true
@@ -152,6 +161,9 @@ paths:
     patch:
       operationId: patchContentHostingConfiguration
       summary: 'Patch the Content Hosting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-hosting-configuration-patch
       requestBody:
         description: 'A JSON representation of a Content Hosting Configuration'
         required: true
@@ -198,6 +210,9 @@ paths:
     delete:
       operationId: destroyContentHostingConfiguration
       summary: 'Destroy the current Content Hosting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-hosting-configuration-delete
       responses:
         '204': # No Content
           description: 'Destroyed Content Hosting Configuration'
@@ -231,6 +246,9 @@ paths:
     post:
       operationId: purgeContentHostingCache
       summary: 'Purge the content of the cache for the Content Hosting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-hosting-configuration-purge
       requestBody:
         description: 'The regular expression pattern for resources to purge from the cache'
         required: true
@@ -280,7 +298,13 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes: 
+            content-hosting-configuration-create: Create a content hosting configuration
+            content-hosting-configuration-read: Read a content hosting configuration
+            content-hosting-configuration-put: Put a content hosting configuration
+            content-hosting-configuration-patch: Patch a content hosting configuration
+            content-hosting-configuration-delete: Delete a content hosting configuration
+            content-hosting-configuration-purge: Purge a content hosting configuration
 
   schemas:
     IngestConfiguration:
diff --git a/TS26510_Maf_Provisioning_ContentPreparationTemplates.yaml b/TS26510_Maf_Provisioning_ContentPreparationTemplates.yaml
index 1832dab4e24f6170b8d0cd4a8dab16ecfdf2b627..4c5d9f0474a43665952d75cca6dd2abefd91c6be 100644
--- a/TS26510_Maf_Provisioning_ContentPreparationTemplates.yaml
+++ b/TS26510_Maf_Provisioning_ContentPreparationTemplates.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: createContentPreparationTemplate
       summary: 'Create (and optionally upload) a new Content Preparation Template for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-preparation-template-create
       requestBody:
         description: 'A Content Preparation Template of any supported type'
         required: true
@@ -94,6 +97,9 @@ paths:
     get:
       operationId: retrieveContentPreparationTemplate
       summary: 'Retrieve the specified Content Preparation Template of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-preparation-template-read
       responses:
         '200': # OK
           description: 'Success'
@@ -122,6 +128,9 @@ paths:
     put:
       operationId: updateContentPreparationTemplate
       summary: 'Update (by replacement) the specified Content Preparation Template for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-preparation-template-put
       requestBody:
         description: 'A Content Preparation Template of any type'
         required: true
@@ -165,6 +174,9 @@ paths:
     patch:
       operationId: patchContentPreparationTemplate
       summary: 'Patch the specified Content Preparation Template for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-preparation-template-patch
       requestBody:
         description: 'A Content Preparation Template patch of any type'
         required: true
@@ -205,6 +217,9 @@ paths:
     delete:
       operationId: destroyContentPreparationTemplate
       summary: 'Destroy the specified Content Preparation Template of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-preparation-template-delete
       responses:
         '204': # No Content
           description: 'Content Preparation Template Destroyed'
@@ -236,4 +251,9 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes:
+            content-preparation-template-create: Create a content preparation template
+            content-preparation-template-read: Read a content preparation template
+            content-preparation-template-put: Put a content preparation template
+            content-preparation-template-patch: Patch a content preparation template
+            content-preparation-template-delete: Delete a content preparation template
diff --git a/TS26510_Maf_Provisioning_ContentProtocols.yaml b/TS26510_Maf_Provisioning_ContentProtocols.yaml
index b007b3af4767f6af7cb5b832a24a9684b7c98baf..7176a7779062823e2cbc673b57e19028d888b6c6 100644
--- a/TS26510_Maf_Provisioning_ContentProtocols.yaml
+++ b/TS26510_Maf_Provisioning_ContentProtocols.yaml
@@ -38,6 +38,9 @@ paths:
     get:
       operationId: retrieveContentProtocols
       summary: 'Retrieve the set of Content Protocols supported by the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - content-protocols-read
       responses:
         '200':
           description: 'Success'
@@ -71,8 +74,8 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
+          scopes:
+            content-protocols-read: Read supported content protocols 
   schemas:
     ContentProtocolDescriptor:
       type: object
diff --git a/TS26510_Maf_Provisioning_EdgeResources.yaml b/TS26510_Maf_Provisioning_EdgeResources.yaml
index 0541cd708177642140c4c0b1db841fd0b68045e4..fb2dfe0d3bb78b6827873c806a297d7a36aa1ea3 100644
--- a/TS26510_Maf_Provisioning_EdgeResources.yaml
+++ b/TS26510_Maf_Provisioning_EdgeResources.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: createEdgeResourcesConfiguration
       summary: 'Create an Edge Resources Configuration within the scope of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - edge-resource-configuration-create
       requestBody:
         description: 'A JSON representation of an Edge Resources Configuration'
         required: true
@@ -93,6 +96,9 @@ paths:
     get:
       operationId: retrieveEdgeResourcesConfiguration
       summary: 'Retrieve the Edge Resources Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - edge-resource-configuration-read
       responses:
         '200': # OK
           description: 'Success'
@@ -121,6 +127,9 @@ paths:
     put:
       operationId: updateEdgeResourcesConfiguration
       summary: 'Update an Edge Resources Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - edge-resource-configuration-put
       requestBody:
         description: 'A JSON representation of an Edge Resources Configuration'
         required: true
@@ -164,6 +173,9 @@ paths:
     patch:
       operationId: patchEdgeResourcesConfiguration
       summary: 'Patch the Edge Resources Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - edge-resource-configuration-patch
       requestBody:
         description: 'A JSON representation of a Edge Resources Configuration'
         required: true
@@ -210,6 +222,9 @@ paths:
     delete: 
       operationId: destroyEdgeResourcesConfiguration
       summary: 'Destroy the specified Edge Resources Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - edge-resource-configuration-delete
       responses:
         '204': # No Content
           description: 'Edge Resources Configuration Destroyed'
@@ -241,7 +256,12 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes:
+            edge-resource-configuration-create: Create an edge resource configuration
+            edge-resource-configuration-read: Read an edge resource configuration
+            edge-resource-configuration-put: Put an edge resource configuration
+            edge-resource-configuration-patch: Patch an edge resource configuration
+            edge-resource-configuration-delete: Delete an edge resource configuration
 
   schemas:
     EdgeResourcesConfiguration:
diff --git a/TS26510_Maf_Provisioning_EventDataProcessing.yaml b/TS26510_Maf_Provisioning_EventDataProcessing.yaml
index a28f77e5333a3676850dd4d84ca2e039fe93609c..5ffa9efe9fa19970a3417bf9349abeb1d20fa049 100644
--- a/TS26510_Maf_Provisioning_EventDataProcessing.yaml
+++ b/TS26510_Maf_Provisioning_EventDataProcessing.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: createEventDataProcessingConfiguration
       summary: 'Supply an Event Data Processing Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - event-data-processing-provisioning-create
       requestBody:
         description: 'A JSON representation of a Event Data Processing Configuration'
         required: true
@@ -94,6 +97,9 @@ paths:
     get:
       operationId: retrieveEventDataProcessingConfiguration
       summary: 'Retrieve the specified Event Data Processing Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - event-data-processing-provisioning-read
       responses:
         '200': # OK
           description: 'Success'
@@ -122,6 +128,9 @@ paths:
     put:
       operationId: updateEventDataProcessingConfiguration
       summary: 'Update the specified Event Data Processing Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - event-data-processing-provisioning-put
       requestBody:
         description: 'A JSON representation of a Event Data Processing Configuration'
         required: true
@@ -165,6 +174,9 @@ paths:
     patch:
       operationId: patchEventDataProcessingConfiguration
       summary: 'Patch the specified Event Data Processing Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - event-data-processing-provisioning-patch
       requestBody:
         description: 'A JSON representation of a Event Data Processing Configuration'
         required: true
@@ -211,6 +223,9 @@ paths:
     delete:
       operationId: destroyEventDataProcessingConfiguration
       summary: 'Destroy the specified Event Data Processing Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - event-data-processing-provisioning-delete
       responses:
         '204': # No Content
           description: 'Event Data Processing Configuration Destroyed'
@@ -240,8 +255,12 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
+          scopes:
+            event-data-processing-provisioning-create: Create an event data processing provisioning
+            event-data-processing-provisioning-read: Read an event data processing provisioning
+            event-data-processing-provisioning-put: Put an event data processing provisioning
+            event-data-processing-provisioning-patch: Patch an event data processing provisioning
+            event-data-processing-provisioning-delete: Delete an event data processing provisioning
   schemas:
     EventDataProcessingConfiguration:
       description: 'A representation of an Event Data Processing Configuration resource.'
diff --git a/TS26510_Maf_Provisioning_MetricsReporting.yaml b/TS26510_Maf_Provisioning_MetricsReporting.yaml
index 3ea30cb36fb15836ad84cb9d3edfdc1df3d62fb3..364aab98649bb6c591abf162be9bce1de27c56ae 100644
--- a/TS26510_Maf_Provisioning_MetricsReporting.yaml
+++ b/TS26510_Maf_Provisioning_MetricsReporting.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: activateMetricsReporting
       summary: 'Activate the Metrics reporting procedure for the specified Provisioning Session by providing the Metrics Reporting Configuration'
+      security:
+        - OAuth2ClientCredentials:
+          - metrics-reporting-create
       requestBody:
         description: 'A JSON representation of a Metrics Reporting Configuration'
         required: true
@@ -94,6 +97,9 @@ paths:
     get:
       operationId: retrieveMetricsReportingConfiguration
       summary: 'Retrieve the specified Metrics Reporting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - metrics-reporting-read
       responses:
         '200': # OK
           description: 'Success'
@@ -122,6 +128,9 @@ paths:
     put:
       operationId: updateMetricsReportingConfiguration
       summary: 'Update the specified Metrics Reporting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - metrics-reporting-put
       requestBody:
         description: 'A JSON representation of a Metrics Reporting Configuration'
         required: true
@@ -165,6 +174,9 @@ paths:
     patch:
       operationId: patchMetricsReportingConfiguration
       summary: 'Patch the specified Metrics Reporting Configuration for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - metrics-reporting-patch
       requestBody:
         description: 'A JSON representation of a Metrics Reporting Configuration'
         required: true
@@ -211,6 +223,9 @@ paths:
     delete:
       operationId: destroyMetricsReportingConfiguration
       summary: 'Destroy the specified Metrics Reporting Configuration of the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - metrics-reporting-delete
       responses:
         '204': # No Content
           description: 'Metrics Reporting Configuration Destroyed'
@@ -240,8 +255,12 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
+          scopes:
+            metrics-reporting-create: Create a metric reporting
+            metrics-reporting-read: Read a metric reporting
+            metrics-reporting-put: Put a metric reporting
+            metrics-reporting-patch: Patch a metric reporting
+            metrics-reporting-delete: Delete a metric reporting
   schemas:
     MetricsReportingConfiguration:
       type: object
diff --git a/TS26510_Maf_Provisioning_PolicyTemplates.yaml b/TS26510_Maf_Provisioning_PolicyTemplates.yaml
index 012d8d7d504024f0954e0c49a6d135b069f8de22..2949439ac13c3e2b10fefe49894f7b479375ed4e 100644
--- a/TS26510_Maf_Provisioning_PolicyTemplates.yaml
+++ b/TS26510_Maf_Provisioning_PolicyTemplates.yaml
@@ -38,6 +38,9 @@ paths:
     post:
       operationId: createPolicyTemplate
       summary: 'Create and upload a new Policy Template for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - policy-template-create
       requestBody:
         description: 'A JSON representation of a Policy Template'
         required: true
@@ -94,6 +97,9 @@ paths:
     get:
       operationId: retrievePolicyTemplate
       summary: 'Retrieve a representation of an existing Policy Template in the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - policy-template-read
       responses:
         '200': # OK
           description: 'Success'
@@ -122,6 +128,9 @@ paths:
     put:
       operationId: updatePolicyTemplate
       summary: 'Update a Policy Template for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - policy-template-put
       requestBody:
         description: 'A JSON representation of a Policy Template'
         required: true
@@ -165,6 +174,9 @@ paths:
     patch:
       operationId: patchPolicyTemplate
       summary: 'Patch the Policy Template for the specified Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - policy-template-patch
       requestBody:
         description: 'A JSON representation of a Policy Template'
         required: true
@@ -210,6 +222,9 @@ paths:
           $ref: 'TS29571_CommonData.yaml#/components/responses/default' 
     delete: 
       operationId: destroyPolicyTemplate
+      security:
+        - OAuth2ClientCredentials:
+          - policy-template-delete
       responses:
         '204': # No Content
           description: 'Policy Template Destroyed'
@@ -239,7 +254,12 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes:
+            policy-template-create: Create a policy template
+            policy-template-read: Read a policy template
+            policy-template-put: Put a policy template
+            policy-template-patch: Patch a policy template
+            policy-template-delete: Delete a policy template
 
   schemas:
     PolicyTemplate:
diff --git a/TS26510_Maf_Provisioning_ProvisioningSessions.yaml b/TS26510_Maf_Provisioning_ProvisioningSessions.yaml
index 57050ffea9bb18abb10dc326208e8e046b88e3bc..e8024fbaee88bff98f555f01d4fb5f1b84b07eef 100644
--- a/TS26510_Maf_Provisioning_ProvisioningSessions.yaml
+++ b/TS26510_Maf_Provisioning_ProvisioningSessions.yaml
@@ -31,6 +31,9 @@ paths:
     post:
       operationId: createProvisioningSession
       summary: 'Create a new Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - provisioning-sessions-create
       requestBody:
         description: 'A JSON representation of a Provisioning Session.'
         required: true
@@ -81,6 +84,9 @@ paths:
     get:
       operationId: getProvisioningSessionById
       summary: 'Retrieve an existing Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - provisioning-sessions-read
       responses:
         '200':
           description: 'Success'
@@ -109,6 +115,9 @@ paths:
     delete:
       operationId: destroyProvisioningSession
       summary: 'Destroy an existing Provisioning Session'
+      security:
+        - OAuth2ClientCredentials:
+          - provisioning-sessions-delete
       responses:
         '204': # No Content
           description: 'Provisioning Session Destroyed'
@@ -138,7 +147,10 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes:
+            provisioning-sessions-create: Create a provisioning session
+            provisioning-sessions-read: Read a provisioning session
+            provisioning-sessions-delete: Delete a provisioning session
 
   schemas:
     ProvisioningSession:
diff --git a/TS26510_Maf_Provisioning_ServerCertificates.yaml b/TS26510_Maf_Provisioning_ServerCertificates.yaml
index e7ceb0c094995f2a2d2ae82c19cd216c1a4156a1..215e1e6b16b8edc8337b78e6219ef795479d97fe 100644
--- a/TS26510_Maf_Provisioning_ServerCertificates.yaml
+++ b/TS26510_Maf_Provisioning_ServerCertificates.yaml
@@ -39,6 +39,9 @@ paths:
       operationId: createOrReserveServerCertificate
       summary: 'Create or reserve a Service Certificate resource'
       description: 'Without the optional csr query parameter, an X.509 certificate is generated and this is returned. If the csr query parameter is present, a Certificate Signing Request is instead generated and returned, allowing the X.509 certificate to be generated by the invoker and later uploaded.'
+      security:
+        - OAuth2ClientCredentials:
+          - certificates-csr-request
       parameters:
         - in: query
           name: csr
@@ -102,6 +105,9 @@ paths:
     put:
       operationId: uploadServerCertificate
       summary: "Upload the X.509 certificate for a previously reserved Server Certificate resource"
+      security:
+        - OAuth2ClientCredentials:
+          - certificates-upload
       requestBody:
         required: true
         content:
@@ -138,6 +144,9 @@ paths:
     get:
       operationId: retrieveServerCertificate
       summary: 'Retrieve the X.509 certificate representation of the specified Server Certificate resource'
+      security:
+        - OAuth2ClientCredentials:
+          - certificates-retrieve
       responses:
         '200':
           description: 'Success'
@@ -168,6 +177,9 @@ paths:
     delete:
       operationId: destroyServerCertificate
       summary: 'Destroy an existing Server Certificate resource'
+      security:
+        - OAuth2ClientCredentials:
+          - certificates-delete
       responses:
         '204': # No Content
           description: 'Server Certificate Destroyed'
@@ -199,4 +211,8 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes:
+            certificates-csr-request: Create a Certificate Signing Resource
+            certificates-upload: Upload a certificate
+            certificates-retrieve: Retrieve a certificate
+            certificates-delete: Delete a certificate
diff --git a/TS26510_Maf_SessionHandling_ConsumptionReporting.yaml b/TS26510_Maf_SessionHandling_ConsumptionReporting.yaml
index 5e61a91d6eaee9230ff157081b73f514efdbe2ff..c905c8d3b7efd618e9e3c3f603c8290c6c70f6c6 100644
--- a/TS26510_Maf_SessionHandling_ConsumptionReporting.yaml
+++ b/TS26510_Maf_SessionHandling_ConsumptionReporting.yaml
@@ -39,6 +39,11 @@ paths:
     post:
       operationId: submitConsumptionReport
       summary: 'Submit a Consumption Report'
+      security:
+        - OAuth2ClientCredentials:
+          - consumption-reporting-create
+        - oAuth2AuthorizationCode:
+          - consumption-reporting-create
       requestBody:
         description: 'A Consumption Report'
         required: true
@@ -79,15 +84,16 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-    OAuth2AuthorizationCode:
+          scopes:
+            consumption-reporting-create: Create consumption report
+    oAuth2AuthorizationCode:
       type: oauth2
       flows:
         authorizationCode:
           authorizationUrl: '{authorizationUrl}'
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
+          scopes: 
+            consumption-reporting-create: Create consumption report
   schemas:
     ConsumptionReport:
       description: "A representation of a Consumption Report."
diff --git a/TS26510_Maf_SessionHandling_DynamicPolicy.yaml b/TS26510_Maf_SessionHandling_DynamicPolicy.yaml
index 78741cde4fe0774ddf95476189420db7000474c8..08d9e68d0c1df4d481dca50b4377d5416f62562b 100644
--- a/TS26510_Maf_SessionHandling_DynamicPolicy.yaml
+++ b/TS26510_Maf_SessionHandling_DynamicPolicy.yaml
@@ -24,14 +24,16 @@ servers:
 
 security:
   - {}
-  - OAuth2ClientCredentials: []
-  - OAuth2AuthorizationCode: []
+  - oauth2_dynamic-policy: []
 
 paths:
   /dynamic-policies:
     post:
       operationId: createDynamicPolicy
       summary: 'Create (and optionally upload) a new Dynamic Policy resource'
+      security:
+        - oauth2_dynamic-policy:
+          - dynamic-policy-create
       requestBody:
         description: 'An optional JSON representation of a Dynamic Policy resource'
         content:
@@ -83,6 +85,9 @@ paths:
     get:
       operationId: retrieveDynamicPolicy
       summary: 'Retrieve an existing Dynamic Policy resource'
+      security:
+        - oauth2_dynamic-policy:
+          - dynamic-policy-retrieve
       responses:
         '200': # OK
           description: 'Success'
@@ -111,6 +116,9 @@ paths:
     put:
       operationId: updateDynamicPolicy
       summary: 'Update an existing Dynamic Policy resource'
+      security:
+        - oauth2_dynamic-policy:
+          - dynamic-policy-replace
       requestBody:
         description: 'A replacement JSON representation of a Dynamic Policy resource'
         required: true
@@ -154,6 +162,9 @@ paths:
     patch:
       operationId: patchDynamicPolicy
       summary: 'Patch an existing Dynamic Policy resource'
+      security:
+        - oauth2_dynamic-policy:
+          - dynamic-policy-patch
       requestBody:
         description: 'A JSON patch to a Dynamic Policy resource'
         required: true
@@ -200,6 +211,9 @@ paths:
     delete:
       operationId: destroyDynamicPolicy
       summary: 'Destroy an existing Dynamic Policy resource'
+      security:
+        - oauth2_dynamic-policy:
+          - dynamic-policy-destroy
       responses:
         '204': # No Content
           description: 'Dynamic Policy Destroyed'
@@ -224,20 +238,26 @@ paths:
 
 components:
   securitySchemes:
-    OAuth2ClientCredentials:
+    oauth2_dynamic-policy:
       type: oauth2
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-    OAuth2AuthorizationCode:
-      type: oauth2
-      flows:
+          scopes:
+            dynamic-policy-create: Create a Dynamic Policy resource
+            dynamic-policy-retrieve: Retrieve a Dynamic Policy resource
+            dynamic-policy-replace: Replace a Dynamic Policy resource
+            dynamic-policy-patch: Patch a Dynamic Policy resource
+            dynamic-policy-destroy: Destroy a Dynamic Policy resource
         authorizationCode:
           authorizationUrl: '{authorizationUrl}'
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
+          scopes: 
+            dynamic-policy-create: Create a Dynamic Policy resource
+            dynamic-policy-retrieve: Retrieve a Dynamic Policy resource
+            dynamic-policy-replace: Replace a Dynamic Policy resource
+            dynamic-policy-patch: Patch a Dynamic Policy resource
+            dynamic-policy-destroy: Destroy a Dynamic Policy resource
   schemas:
     DynamicPolicy:
       description: "A representation of a Dynamic Policy resource."
diff --git a/TS26510_Maf_SessionHandling_MetricsReporting.yaml b/TS26510_Maf_SessionHandling_MetricsReporting.yaml
index 6f75beae8de5edfe9b6aeaf8ee2a0e96e99386fb..415f93634a98101b811179d94f018739732ff547 100644
--- a/TS26510_Maf_SessionHandling_MetricsReporting.yaml
+++ b/TS26510_Maf_SessionHandling_MetricsReporting.yaml
@@ -45,6 +45,11 @@ paths:
     post:
       operationId: submitMetricsReport
       summary: 'Submit a Metrics Report'
+      security:
+        - OAuth2ClientCredentials:
+          - metrics-reporting-create
+        - oAuth2AuthorizationCode:
+          - metrics-reporting-create
       requestBody:
         description: 'A Metrics Report'
         required: true
@@ -89,11 +94,13 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-    OAuth2AuthorizationCode:
+          scopes:
+            metrics-reporting-create: Create a metrics report
+    oAuth2AuthorizationCode:
       type: oauth2
       flows:
         authorizationCode:
           authorizationUrl: '{authorizationUrl}'
           tokenUrl: '{tokenUrl}'
-          scopes: {}
+          scopes: 
+            metrics-reporting-create: Create a metrics report
diff --git a/TS26510_Maf_SessionHandling_NetworkAssistance.yaml b/TS26510_Maf_SessionHandling_NetworkAssistance.yaml
index 643b06d69378badccf2418ded109800112de4b34..e8d64ab1068495ce4eeff706c123c5150e6e9563 100644
--- a/TS26510_Maf_SessionHandling_NetworkAssistance.yaml
+++ b/TS26510_Maf_SessionHandling_NetworkAssistance.yaml
@@ -32,6 +32,11 @@ paths:
     post:
       operationId: createNetworkAssistanceSession
       summary: 'Create a new Network Assistance Session.'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-create
+        - oAuth2AuthorizationCode:
+          - network-assistance-create
       requestBody:
         description: 'The initial parameters for the Network Assistance Session resource'
         content:
@@ -83,6 +88,11 @@ paths:
     get:
       operationId: retrieveNetworkAssistanceSession
       summary: 'Retrieve an existing Network Assistance Session resource'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-get
+        - oAuth2AuthorizationCode:
+          - network-assistance-get
       responses:
         '200': # OK
           description: 'Success'
@@ -111,6 +121,11 @@ paths:
     put:
       operationId: updateNetworkAssistanceSession
       summary: 'Update an existing Network Assistance Session resource'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-put
+        - oAuth2AuthorizationCode:
+          - network-assistance-put
       requestBody:
         description: 'A replacement JSON representation of a Network Assistance Session resource'
         required: true
@@ -154,6 +169,11 @@ paths:
     patch:
       operationId: patchNetworkAssistanceSession
       summary: 'Patch an existing Network Assistance Session resource'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-patch
+        - oAuth2AuthorizationCode:
+          - network-assistance-patch
       requestBody:
         description: 'A JSON patch to a Network Assistance Session resource'
         required: true
@@ -200,6 +220,11 @@ paths:
     delete:
       operationId: destroyNetworkAssistanceSession
       summary: 'Destroy an existing Network Assistance Session resource'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-delete
+        - oAuth2AuthorizationCode:
+          - network-assistance-delete
       responses:
         '204': # No Content
           description: 'Network Assistance Session Destroyed'
@@ -226,6 +251,11 @@ paths:
     get:
       operationId: requestBitRateRecommendation
       summary: 'Obtain a bit rate recommendation for the next recommendation window'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-getrec
+        - oAuth2AuthorizationCode:
+          - network-assistance-getrec
       parameters:
         - name: naSessionId
           description: 'The resource identifier of an existing Network Assistance Session resource'
@@ -262,6 +292,11 @@ paths:
     post:
       operationId: requestDeliveryBoost
       summary: 'Request a delivery boost'
+      security:
+        - OAuth2ClientCredentials:
+          - network-assistance-boost
+        - oAuth2AuthorizationCode:
+          - network-assistance-boost
       parameters:
         - name: naSessionId
           description: 'The resource identifier of an existing Network Assistance Session resource'
@@ -304,16 +339,28 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-    OAuth2AuthorizationCode:
+          scopes:
+            network-assistance-create: Create a network assistance session
+            network-assistance-read: Read a network assistance session
+            network-assistance-put: Put a network assistance session
+            network-assistance-patch: Patch a network assistance session
+            network-assistance-delete: Delete a network assistance session
+            network-assistance-getrec: Obtain a bit rate recommendation
+            network-assistance-boost: Request a delivery boost
+    oAuth2AuthorizationCode:
       type: oauth2
       flows:
         authorizationCode:
           authorizationUrl: '{authorizationUrl}'
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
-
+          scopes: 
+            network-assistance-create: Create a network assistance session
+            network-assistance-read: Read a network assistance session
+            network-assistance-put: Put a network assistance session
+            network-assistance-patch: Patch a network assistance session
+            network-assistance-delete: Delete a network assistance session
+            network-assistance-getrec: Obtain a bit rate recommendation
+            network-assistance-boost: Request a delivery boost
   schemas:
     NetworkAssistanceSession:
       description: "A representation of a Network Assistance Session resource."
diff --git a/TS26510_Maf_SessionHandling_ServiceAccessInformation.yaml b/TS26510_Maf_SessionHandling_ServiceAccessInformation.yaml
index 49ffee530e32bd915260f46cdcc63a8521830ff1..43a7bf0014798781f249a094655f49704df2a589 100644
--- a/TS26510_Maf_SessionHandling_ServiceAccessInformation.yaml
+++ b/TS26510_Maf_SessionHandling_ServiceAccessInformation.yaml
@@ -39,6 +39,11 @@ paths:
     get:
       operationId: retrieveServiceAccessInformation
       summary: 'Retrieve the Service Access Information resource'
+      security:
+        - OAuth2ClientCredentials:
+          - service-access-information-read
+        - oAuth2AuthorizationCode:
+          - service-access-information-read
       responses:
         '200': # OK
           description: 'Success'
@@ -72,15 +77,16 @@ components:
       flows:
         clientCredentials:
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-    OAuth2AuthorizationCode:
+          scopes:
+            service-access-information-read: Read service access session
+    oAuth2AuthorizationCode:
       type: oauth2
       flows:
         authorizationCode:
           authorizationUrl: '{authorizationUrl}'
           tokenUrl: '{tokenUrl}'
-          scopes: {}
-
+          scopes:
+            service-access-information-read: Read service access session
 
   schemas:
     M5MediaEntryPoint:
diff --git a/TS26512_Maf_Provisioning.yaml b/TS26512_Maf_Provisioning.yaml
index 1bf38a1ca4a0b80432d1158f38694a175b50ea72..01f387f9a613b39409e2447845ba8a3d4dabcd4f 100755
--- a/TS26512_Maf_Provisioning.yaml
+++ b/TS26512_Maf_Provisioning.yaml
@@ -22,19 +22,6 @@ servers:
         default: https://example.com
         description: See 3GPP TS 29.512 clause 6.1.
 
-security:
-  - {}
-  - OAuth2ClientCredentials: []
-
-components:
-  securitySchemes:
-    OAuth2ClientCredentials:
-      type: oauth2
-      flows:
-        clientCredentials:
-          tokenUrl: '{tokenUrl}'
-          scopes: {}
-
 paths:
   # Provisioning Sessions API
   /provisioning-sessions:
diff --git a/TS26512_Maf_SessionHandling.yaml b/TS26512_Maf_SessionHandling.yaml
index 47b79d97c14f2f177f7b47d980b5e6e0eb3732e3..0ecc26fc4ed3a709216e6b9f7c12582325f7015b 100755
--- a/TS26512_Maf_SessionHandling.yaml
+++ b/TS26512_Maf_SessionHandling.yaml
@@ -22,26 +22,6 @@ servers:
         default: https://example.com
         description: See 3GPP TS 29.512 clause 6.1.
 
-security:
-  - {}
-  - OAuth2ClientCredentials: []
-  - OAuth2AuthorizationCode: []
-
-components:
-  securitySchemes:
-    OAuth2ClientCredentials:
-      type: oauth2
-      flows:
-        clientCredentials:
-          tokenUrl: '{tokenUrl}'
-          scopes: {}
-    OAuth2AuthorizationCode:
-      type: oauth2
-      flows:
-        authorizationCode:
-          authorizationUrl: '{authorizationUrl}'
-          tokenUrl: '{tokenUrl}'
-          scopes: {}
 
 paths:
   # Service Access Information API