title: Token distribution to unknown party
body: <p>If I distribute received OAuth access token (in the background) to multiple other clients who are not part of the original OAuth flow then what could be the security problem? I am kind of trying to achieve the delegation to those parties who are not even present in the OAuth flow something like UMA ...correct me ..I could be totally wrong here</p>