JWT tokens authenticate the client, not the user
The distinction between client vs user is semantic quibbling - it&#x27;s not possible to authenticate the user, only the agents, or clients, which act on behalf of the user. We can&#x27;t interact with the user directly. We can only talk to the user&#x27;s agent. JWTs just cache the verification of some secret which we hope the user has supplied.<p>What the article actually seems to be asserting is that permission checking should be done via calls to an IAM and not via claims in the JWT (if I&#x27;m understanding it right).<p>I don&#x27;t buy this either. Tokens can cache permissions, albeit with the same staleness issues that JWTs have for authentication. It&#x27;s not much different than how a driving license is both evidence of identity and evidence of a permission.<p>The claims might be stale, but we have the same problem for revoking JWTs.