19bc67c196
When I thought change I2b4bcc748b6e43e4215dc45137becce301349032 was going to fix everything, that was with the mental model that it was going to be enabled by default. That didn't happen in review as part of the service, but the reality is we still have some adjacent CI jobs which need it to operate properly. Given CI, it is just invoked when scope enforcement is enabled for CI purposes Change-Id: I60074504742d8b09017acbb42d2706215b0169af