An access token is intended for a particular resource; its existence is not permission to call every API. Auth0 explains the role of the audience parameter in selecting that resource.
With the Auth0 directory entry, test a correctly targeted token and one issued for a different audience. The protected API should reject the latter even if the user signed in successfully. Keep authentication, token validation and application permissions as distinct checks.
Akousa