That would make a good Flowable blog post 
A Spring Boot App + Flowable (Tasks) REST API + No Security (e.g., no Basic Auth).
Then add support for OAuth scopes using Spring Security OAuth Resource Server.
Also, see: Add support for OAuth 2.0 to Flowable's REST APIs