One declaration, with the derivedAudience recomputed from the current
public edge URL — so the value shown here is always the value the validation path
requires right now, and a change to that URL can never leave a stale one behind.

🔴 An issuer id belonging to a different tenant answers 404, not 403. That is not a rounding of the refusal: a

403 for a row that exists and a 404 for one that does not is an existence oracle,
and what it would enumerate on a shared deployment is which authorization servers
other customers trust. The two cases are byte-identical here.

Ungated.