Custom authorization logic when token exchange flow is triggered in Spring authorization server

Expected Behavior
I want to be able to apply additional authorization checks during Token exchange flow (OAuth2TokenExchangeAuthenticationToken)

I have different kind of users, for simplification, let's assume administrator and normal user. I need to support a case that only Administrator can impersonate normal user, and only certain Administrators can do the impersonation

For time being, we can assume that information if user is an administrator can be deduced from his token claims. And to check if administrator can impersonate, a dedicated API call needs to be made to validate

I expect that

1. When administrator who can do the impersonation, calls token endpoint with grant type: urn:ietf:params:oauth:grant-type:token-exchange, will receive http 200 response with impersonating token
2. When user who cannot do the impersonation, calls token endpoint with grant type urn:ietf:params:oauth:grant-type:token-exchange, will receive an error. Can be 403/401, whatever is feasible

Current Behavior
There is no easy way at the moment to customize spring authorization server implementation to support the above. The only option, is to replace whole org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenExchangeAuthenticationProvider with custom implementation which will inject additional checks

The above option is not good as this requires replacing copying the whole class and customizing it so it will increase maintenance burden for me during spring upgrades

Start by reading OAuth2TokenExchangeAuthenticationProvider and the token endpoint flow for OAuth2TokenExchangeAuthenticationToken. Identify the supported extension point for applying claims-based administrator and impersonation checks without copying the provider. Done means authorized exchanges succeed and unauthorized users receive an error, with coverage for both outcomes.