After having thought about it for a while... it should be correct to say that the authorization server defines the scopes and the resource server implements them.
A client requests authorization for a scope which the user gives consent to (authorization grant). Then the client sends the authorization grant to the authorization server to get an access token in return.
That access token must contain the signed scope that the user has given consent to, which in turn means the authorization server needs to be aware of all the scopes that can be requested.
Then it's up to the resource server to: