It's not about verification of the jwt, it's about hiding the roles from the user.