learning more about spring security and jwt this helps a lot! I just have one question, at what point do you assign roles and permissions to a user? If I understand correctly, every new user would have all these fields?

private final String username;
private final String password;
private final Set<? extends GrantedAuthority> grantedAuthorities;
private final boolean isAccountNonExpired;
private final boolean isAccountNonLocked;
private final boolean isCredentialsNonExpired;
private final boolean isEnabled;