diff --git a/src/infra/device-pairing.ts b/src/infra/device-pairing.ts
index 69cd4cfc461..5a2caab853d 100644
--- a/src/infra/device-pairing.ts
+++ b/src/infra/device-pairing.ts
@@ -177,6 +177,17 @@ function mergePendingDevicePairingRequest(
   };
 }
 
+function scopesAllow(requested: string[], allowed: string[]): boolean {
+  if (requested.length === 0) {
+    return true;
+  }
+  if (allowed.length === 0) {
+    return false;
+  }
+  const allowedSet = new Set(allowed);
+  return requested.every((scope) => allowedSet.has(scope));
+}
+
 const DEVICE_SCOPE_IMPLICATIONS: Readonly<Record<string, readonly string[]>> = {
   "operator.admin": ["operator.read", "operator.write", "operator.approvals", "operator.pairing"],
   "operator.write": ["operator.read"],