diff --git a/src/privet/privet_handler.cc b/src/privet/privet_handler.cc
index 7afeb3b..97cacc5 100644
--- a/src/privet/privet_handler.cc
+++ b/src/privet/privet_handler.cc
@@ -713,6 +713,8 @@
     return ReturnError(*error, callback);
   }
 
+  CHECK_LE(access_token_scope, desired_scope);
+
   if (access_token_scope < acceptable_scope) {
     Error::AddToPrintf(&error, FROM_HERE, errors::kAccessDenied,
                        "Scope '%s' is not allowed",
diff --git a/src/privet/security_manager.cc b/src/privet/security_manager.cc
index 3b08613..3c11935 100644
--- a/src/privet/security_manager.cc
+++ b/src/privet/security_manager.cc
@@ -144,9 +144,11 @@
         return disabled_mode(error);
       const base::TimeDelta kTtl =
           base::TimeDelta::FromSeconds(kAccessTokenExpirationSeconds);
-      return auth_manager_->CreateAccessTokenFromAuth(
+      bool result = auth_manager_->CreateAccessTokenFromAuth(
           auth_code, kTtl, access_token, access_token_scope, access_token_ttl,
           error);
+      *access_token_scope = std::min(*access_token_scope, desired_scope);
+      return result;
   }
 
   return Error::AddTo(error, FROM_HERE, errors::kInvalidAuthMode,