Scopes let you control what services / APIs can be called from DEFAULT service accounts. Only Default SAs get to be defined by scopes (since their default scope can be excessive).
Custom Service accounts can not be limited via scopes - you need to use Cloud IAM to grant granular access to custom service accounts.
I am passionate about getting cloud solutions right the first time. I help customers transition to the public cloud with the appropriate security controls and guardrails. GCP, AWS and Azure Security Specialist. <a href="https://calendly.com/anujvarma/google-cloud-architect-initial-consultation">Initial Consultation</a>