Another relevant spec might be transaction tokens: https://datatracker.ietf.org/doc/draft-ietf-oauth-transaction-tokens/

We are looking into possibly deploying this standard. It is exactly suited to external-internal exchanges. It is designed for the case you mention in the beginning of the document: a gateway receives an external request and authenticates utilizing trust established with some external trust domain(s). Then, it issues an internal token. Except instead of an access token, which is typically relatively broadly scoped and longer lived, it issues a "transaction token" which is specifically scoped to a single transaction. It is also designed to be passed along a call chain intentionally, whereas with access tokens this is kind of an abuse of bearer tokens and doesn't work with sender-constrained tokens.

It's an interesting spec! We are trying to figure out if we should use it, and what should issue the token? Keycloak is one option we are wondering about.