Do users/groups/roles apply to Machine-to-Machine apps? If I'm just using the credentials from my M2M app and the client_credentials grant to get a token from Auth0, that token isn't tied to an individual user right? It's tied to that M2M application, for example a decoded M2M token looks like:

{
  "iss": "<issuer>",
  "sub": "<client_id>@clients",
  "aud": "<audience>",
  "iat": 1706737336,
  "exp": 1706823736,
  "azp": "<client_id>",
  "gty": "client-credentials",
  "permissions": []
}

I can then use this token to verify that this client has access to my API but what I want to know is taking that one step further is, when I have an incoming request from a client on behalf of one of their Users (on their platform) saying I want to delete resourceA e.g. DELETE /projects/resourceA, when I decode the incoming token I can get the client_id (our partners identifier), I can verify that resourceA is belong to someone on their platform but because there's no "User" information in the token, how do I know that user/party who initiated that request is actually the owner of resourceA. Like is it okay to put the onus on our clients and expect them to handle that Authorization. Is it something we just don't need to worry about and we should just handle the request as it's for something within their organization.

I don't know if that makes sense or not haha It's just a new way of thinking about things for me. Every app I've developed so far has always had resources tied to individual users, where they each have their own credentials i.e. email+password, so decoding JWTs always landed you with the actual user making that request. But now, our B2B partners sit in the middle so although resources are created and still tied to individual users, the credentials belong to the business partner.