cras/lib/fiori/template/mta/xs-security.json

cras cli

{
    "xsappname": "<%= appname %>",
    "tenant-mode": "dedicated",
    "description": "Security profile of called application",
    "scopes": [
      {
        "name": "uaa.user",
        "description": "UAA"
      }
    ],
    "role-templates": [
      {
        "name": "Token_Exchange",
        "description": "UAA",
        "scope-references": [
          "uaa.user"
        ]
      }
    ]
  }