SAMPLE EVIDENCE for AU-02 (made-up app Tidyhaus; not a real review)

POST /auth/v1/token?grant_type=refresh_token with the old refresh token -> HTTP 400 "Invalid Refresh Token".
Old access token: worked until 14:31:07, its exp time; HTTP 401 after. JWT expiry setting: 3600.