Make sure we have a real design about what an RPC "client scope" is
This is related to #1055, but a bit more general.
We have a notion of "scopes" around the edges of our RPC designs, where each scope represents a different domain of what clients can do and see. But how do these scopes interact with our capability-based design? How are they represented in the source code? What do they mean, even?