IdentityServer4 and resource isolation - oauth-2.0

Question

Does IdentityServer4 feature resource isolation?
here's a plain explanation, taken from this article
Let’s assume you have the following resource design and that the client is allowed access to all scopes:
var resources = new[]
{
new ApiResource("urn:invoices")
{
Scopes = { "read", "write" }
},
new ApiResource("urn:products")
{
Scopes = { "read", "write" }
}
};
If the client would request a token for the read scope, the resulting access token would contain the audience of both the invoice and the products API and thus be accepted at both endpoints. Even if you ask for one resource, the returned token will include both
{
"aud": ["urn:invoice", "urn:products"],
"scope": "read",
"client_id": "client"
}
If the client in addition passes the resource parameter specifying the name of the resource where it wants to use the access token, the token engine can down-scope the resulting access token to the single resource, e.g.:
POST /token
grant_type=client_credentials&
client_id=client&
client_secret=...&
scope=read&
resource=urn:invoices
Thus resulting in an access token like this (some details omitted):
{
"aud": [ "urn:invoice" ],
"scope": "read",
"client_id": "client"
}
note urn:products is not part of the aud, because resource isolation was applied.
How can I achieve this isolation using IdentityServer4?