Resource Indicators (RFC 8707) & Protected Resource Metadata
In distributed microservice architectures, clients frequently need to communicate with multiple downstream resource servers (APIs). By default, standard OAuth 2.0 access tokens can have broad audiences, meaning a token intended for one API might be accepted by another if audience validation is permissive.