[lyschoening]

Maybe the author meant permissions such as 'read-only' or 'read-write' that place additional restrictions on a token.

Anything else would cause a lot of problems. Role permissions might change while a token is still active.

[TheThing]

That is basically it: Additional restriction applied to the token.

I was actually referencing this article: https://auth0.com/blog/2014/12/02/using-json-web-tokens-as-a...

[1rae]

Thanks for clearing it up.