oauth2 1 Where Domain Roles Should Live: The Boundary Between the Authorization Server and the Resource Server Sep 28, 2026