I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded:
I associate JWTs with the OpenID Connect protocol, where there are used as ID tokens. They have in intended audience. The claims in them are supposed to be for that audience only. For example I may be happy for one audience to have my phone number but not another.
On the other hand an opaque access token contains nothing other than my permission to access a resource. It's about delegation; that token can safely travel from system to system taking my permission with it (confirm?).
However if you effectively use an ID token as an Access Token, not only are you passing my permission to access a resource, but you're passing details about me.
Have I misunderstood something or should this be a real concern?