The resolver's JWT half: the groups claim for a token's context.
the claim set; accepted and unread, since every set carries the claim
the issuance context: username or subject, and client_id or audience
username
subject
client_id
audience
{ <claim>: [groups] }, or {} when there are none
{ <claim>: [groups] }
{}
The resolver's JWT half: the groups claim for a token's context.