HUMAN VERIFICATION REQUIRED ASVS 10.3.2 Delegated authorization claims (when oauth_oidc is used)

The resource server enforces authorization decisions based on claims from the access token that define delegated authorization. If claims such as 'sub', 'scope', and 'authorization\_details'are present, they must be part of the decision.