ID TOKEN JAG TOKEN DATA JAG TOKEN { "aud": "mcp-server-db", "scope": "read" } AI CLIENT ENTERPRISE IDP MCP SERVER Desktop application running locally. Okta/Azure AD issues scoped JAG tokens. Internal Database validates JAG token.