Comment by maxboone

Isn't this the point of JWTs that are signed with a shared secret (or public-private) but contain the right / necessary scopes?