Access tokens are audience-restricted in accordance with organization-defined identification and authentication policy.
No STIG checks reference this CCI.