How can I allow a non-root service to run child processes in scopes.

The real problem I have is that I have a service which spawns child processes and I want to limit how much memory those processes are allowed to use.

systemd scopes seem like the right tool for this, however, if the service is run as non-root, then running `systemd-run --scope` complains that interactive authentication is required. Adding the `--user` option just results in not being able to find the session bus. How can I allow a non-root service to create transient scopes? Being able to group those scopes under a slice would be nice too.