There needs to be a way to see what audience the credential composer is mutating a JWT for, so it can make decisions.