OAuth tests often stop at “the token was returned. ” That proves the protocol completed, but it does not prove that the right client, tenant, user, or scope received access. A test token can be cryptographically valid and still represent a broken security boundary.
Source: [Dev.to](https://dev.to/sophiax99/oauth-test-tokens-need-a-trust-boundary-204)