HUMAN VERIFICATION REQUIRED ASVS 10.3.1 Access-token audience (when oauth_oidc is used)

The resource server only accepts access tokens that are intended for use with that service (audience). The audience may be included in a structured access token (such as the 'aud'claim in JWT), or it can be checked using the token introspection endpoint.