You could use hashed token claims to encode a role or other identifying info.

If you use a webhook you don't have to worry about this, since the user doesn't get to see what you forward as the authorization claims payload. But if you're using a JWT to hold state, since JWT's are publicly viewable it has to be non-obvious and non-deterministic.

IE, something like:

  { "user_id": 5316, "$2a$09$ckHFIEsR8Sjveh1ynOLKguynRDGjEfMCZz0vsUk/Jtm/cW1SxibaK": "$2a$09$pCyjFN6perhHNspS1NFj0eScZ4.ZlOzzPMXhoMrYVmNLMx3MvXdYK" }

Where in the example above, the key is "X-User-Role" and the value is "moderator" that have been bcrypt hashed.

Probably you would want to choose more obscure/uncommon words. I'm not familiar with the details of hashing but it seems like a good idea.

Then you can attach the role (or other identifying) metadata to each request in a way that isn't immediately obvious what it's for.

Disclaimer: I'm not a security expert, possible (probable?) there is a gaping hole in this and it's an awful idea.