title: Is setting Roles in JWT a best practice?
body: <p>I am considering to use JWT. In the <a href="https://jwt.io/" rel="noreferrer">jwt.io example</a> I am seeing the following information in the payload data:</p>
  
  <pre><code>"admin": true
  </code></pre>
  
  <p>Admin can be considered as a Role, hence my question. Is setting the role in the token payload a habitual/good practice? Given that roles can be dynamically modified, I'm quite interrogative.</p>