i have 4 control action add, edit, delete, view is it ok to store access control in JWT.
access object in jwt look like this

{
  access: {
    user: {
      add: true,
      edit: true,
      delete: false,
      view: false
    },
    product: {
      add: true,
      edit: false,
      delete: false,
      view: false
    }
  }
}

so if add is true, create button is disabled or hidden. of course i do role validation in the backend too.

is it ok to do? is it safe?