RBAC versus scopes

One boolean in VerifyAudience decides whether a JWT with no audience claim gets through

A dev.to walkthrough of Go microservice authorization puts the entire audience contract on that single argument, and its own deliberately minimal example checks the required scope against the sub claim.