JWT governance