You’re free to add any additional information that your application requires. Just remember to keep it short, as JWT has to fit in the HTTP header. This richness means that you can pass JWTs around in your system as a fully contained unit of credentials.