Where Domain Roles Should Live: The Boundary Between the Authorization Server and the Resource Server
In short: domain roles belong where the domain lives. Putting them on the auth server couples it to someone else’s business model, and baking them into the JWT freezes them for the lifetime of the ...