OAuth Token Exchange — RFC 8693

Supports narrowing audience/scope and service-to-service delegation — strong for planner-executor architectures and downstream APIs. Adds trust and STS design complexity.