Kitto.AccessControl.JWT

JWT-claim-based access controller. Reads grants from the kx_acl claim embedded in the JWT at login time (by TKJWTEngine.BuildAclFromDB) and replays the same matching logic as TKDBAccessController/TKUserPermissionStorage.

Closed-world: if the kx_acl claim is missing, or a (resource, mode) is not covered by any row, the result is "deny" (no fallback to DB). This matches the contract implied by AccessControl: JWT in Config.yaml: the claim is the sole source of truth. If the application needs DB-driven ACL evaluation, configure AccessControl: DB instead — Auth: JWT can still be used independently for authentication.

Trade-off: ACL grants are snapshotted at login and cached in the JWT for its lifetime. A grant change applied to the database mid-session is NOT reflected until the user logs in again. Keep TokenLifetime / SlidingThreshold reasonable, or force re-login from an admin tool when grants change.