...
"MM": The client application. ("Member Manager")
"GS": The resource server ("Group Service")
"GS-AS": The authorization service aspect of the resource server ("Group Service - Authorization Service")
Authorization flow:
0) The MM has already acquired an identity JWT from TS to GS-AS. (API Client Authentication via OAuth)
...