I am really interested in this work on JWT. We've been using it quite a lot. For instance we use JWT to link an application written in PHP to a Firebase backend. Works beautifully. The thing that I am still trying to wrap my head around, is whether there is a – standard – way of using the claims asserted in the JWT token to control access to objects in a Pharo/seaside application. I know that gemstone has an access control list system but does anything like that exist in Pharo? If not, how do people control access to the data? Cheers Andy,