OAuth Token Audience Guard

Use this endpoint when you have already performed local cryptographic signature verification on an OAuth or JWT token and need a second-layer check that the audience and issuer claims are semantically correct and match expected values. Prefer it over full token verification endpoints when cryptographic validation is handled locally (e.g. by a library) and you specifically want to guard against audience confusion attacks or issuer substitution in agent-to-agent or agent-to-service authentication flows.

• Token audience does not match expected value — returns mismatch error with found vs expected aud
• Issuer claim absent or unrecognized — returns issuer validation failure
• Malformed JWT structure prevents claim extraction — returns parse error
• Token already expired — may surface expiry warning alongside audience check
• Missing required claims in token payload — returns incomplete claims error