Access tokens growing large, how do I mitigate?

[tyf]

Hey there @jetjacobs!

I’m not sure how much of an effect it will have on the size of tokens, but I’ve definitely seen where roles are used instead of adding actual permissions to tokens. That is, you would infer permissions based on the roles in order to consolidate.

How to get permissions for user?

@ilyas-shah, Permissions aren’t available from the context object in rules as you have likely noticed. You could infer from your roles what permissions should be added. I think this is the intended relationship between roles and permissions, so you don’t have to include a group of permissions in a token. Just the user’s roles. You could also make a call to the management api to see what permissions are associated with which role. Thanks, Dan