At the moment the criteriaTypes Role and GroupId are created from the "roles" or "groups" claims in the JWT. But they are only unique inside one token provider identified by the "iss" claim. If more than one token provider is used in a system, the "iss" is required.

Propose the following addition:
If the issuedTokenType of the Access Token is “http://opcfoundation.org/UA/UserToken#JWT”, the criteria shall be dependend on the existence of the “iss” (issuer) field of the JWT IssuedIdentityToken. If it is present, the criteria shall be the concatenation of the value of the “iss” field of the JWT IssuedIdentityToken, a ‘/’ (slash) as separator and the name of of the restriction, which is found in the Access Token. If it not present, it is only the restriction, which is found in the Access Token.