Once we remove FGAP, we should at least make sure that requester client, which triggers token-exchange request, is included as an audience in the provided subject_token . Related task is #37108 for removing FGAP (Maybe makes sense to do both these tasks together?)