01 / What each boundary answers
Compare the decision, not the label.
Describes access requested or granted at a protected resource; token audience and scope are essential transport checks.
Evaluates exact operation, resource instance, parameters, task and current business constraints.
02 / Same operating case
Which request must be stopped?
A token has customer.write scope, but an agent tries to change a different customer’s payout account.
Evaluation exercise
Use the same customer.write token for a permitted address update and an unapproved payout-account update. The resource server must distinguish target field and purpose.
03 / Architecture fit
How the controls can compose
Resource servers should use token facts as inputs to a narrower API authorization decision.
An OAuth deployment can use fine-grained scopes; the gap depends on actual scope design and resource-server enforcement.
04 / Evidence
Prove the decision and the effect separately.
Token validation, scope, customer and field, grant, decision and record delta.
Primary sources