Assess learners' ability to design and implement role-based access control in a web application using JWTs and middleware. Scope includes defining roles and permissions, embedding and validating role claims in JWTs, secure token issuance/expiration/refresh and revocation strategies, middleware patterns to enforce role- and permission-based route protection, error handling and least-privilege design, and writing brief middleware pseudocode or snippets and tests for a common framework (e.g., Express, Django, ASP.NET). Tasks require applied solutions: JWT claim format, middleware logic, sample protected routes, and security trade-offs.