More than that, the bearer model of OAuth doesn't guarantee the token represents a particular user or even a particular client. Any assertion that you are deal

More than that, the bearer model of OAuth doesn't guarantee the token represents a particular user or even a particular client. Any assertion that you are dealing with a particular person needs to be targeted at you. There were security vulnerabilities with some early OAuth deployments that used OAuth for authentication which didn't understand this - and that allow one service that had a relationship with a user to act as that user against all other services which trusted that AS. For Facebook, they solve this by having the token stamp information about which client it was issued to, which the client is required to verify. For OpenID Connect, they decided to preserve the ability of OAuth access tokens to be opaque to the client, and create a new token called an id_token.