Scenario 3: Two different microservices (Accounts and Loans) both trust the same Keycloak realm. How do you prevent a token meant for Accounts from being replayed against Loans?

Configure and validate the 'aud' (audience) claim on the JWT for each resource server — each service should reject tokens whose audience doesn't explicitly include itself. This typically requires configuring distinct audiences per client/scope in Keycloak and adding an audience validator on each resource server's JWT decoder.