# `AttestoPhoenix.ResourceAudiencePolicy`
[🔗](https://github.com/XukuLLC/attesto_phoenix/blob/v2.1.0/lib/attesto_phoenix/resource_audience_policy.ex#L1)

Resolves the trusted RFC 8707 audience set for an Attesto access token.

Static resource identifiers are grant-agnostic and require no client lookup.
When a token carries an audience outside that static set, the signed
`client_id` selects the original OAuth client and its
`resource_indicators[:allowed_resources_for]` policy. The client that calls
introspection or token exchange never supplies this issuance policy.

`resolver/1` is intended for `Attesto.Token.verify/3`'s
`:trusted_audiences` option. The core invokes it only after every other token
check succeeds and converts resolver failures into `:invalid_audience`.

A dynamic audience on a CIMD client may consult the bounded, SSRF-guarded
client-metadata resolver. Successful documents are cached; a fetch failure is
deliberately not cached under the CIMD/RFC 9111 rules and makes that token
inactive. Static audiences bypass client resolution and all network work.

# `resolver`

```elixir
@spec resolver(AttestoPhoenix.Config.t()) :: (map() -> [String.t()])
```

Returns a verifier callback bound to the given authorization-server configuration.

# `trusted_audiences`

```elixir
@spec trusted_audiences(AttestoPhoenix.Config.t(), map()) :: [String.t()]
```

Resolves the static and, when needed, original-client resource allowlist.

---

*Consult [api-reference.md](api-reference.md) for complete listing*