Architect a security layer for a public API that requires fine-grained access control. Define the OAuth2 grant types appropriate for different client types (web, mobile, machine-to-machine). Explain how to integrate OpenID Connect (OIDC) for identity layering and implement JSON Web Tokens (JWT) with appropriate claims to enforce resource-level permissions without relying on a central database lookup for every request.