title: Does ASP.NET Core's policy-based authorization require specific claim types in the token?
body: <p>I'm thinking about switching from role-based to <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-6.0" rel="nofollow noreferrer">policy-based authorization</a> in my ASP.NET Core API.</p>
  <p>I am currently using JWT to handle authorization, with the current user's role added to the access token as a <code>ClaimTypes.Role</code>. My guess is that the default <code>[Authorize]</code> attribute uses the <code>ClaimsPrincipal.IsInRole()</code> method to authorize requests, which in turn looks specifically at claims where the claim type equals <code>ClaimTypes.Role</code>.</p>
  <p>Now if I switch over to policy-based authorization, I need to replace roles with permissions inside my access tokens. The question is, am I okay to continue adding those permissions to my token as <code>ClaimTypes.Role</code>, or should I be using a different <code>ClaimTypes</code>?</p>