[keycloak-user] Signed JWT and Policy Enforcement