> Do not persist or store access tokens anywhere but in-memory.
Using short lived ATs is one defense against this happening, such as if an attacker compromises one of your services and starts scraping tokens off of it.
Ideally, the services should also have some sort of checks (such as service accounts), to ensure that only approved services can talk to each other.
