Yes, we are sending and validating the JWT with every request but the problem here is that the JWT does not contain any information about the user’s authority. If we can add this information as a context parameter to the JWT - which is generated via AP.context.getToken() - then we can check that parameter on the server-side without sending an additional request to Jira. According to Context Parameters, it seems that this is not possible.