Thanks, that does help a bit; glad to know that audience can be a list.
I found some nice examples of scopes here: https://oauth.net/2/scope/
So for example, I could imagine multiple Fitbit Microservices (‘audiences’) with access to biometric data, with this you could granularly control the combinations of Services with ‘Heartrate’ access.