# Internal Security

This package owns the application's administrator JWT policy. It is kept
inside `internal` because its claims, audience, issuer and password-version
fields are KRA-specific security protocol, not a reusable JWT utility.

Generic stateless helpers may live in `pkg`, but admin token signing and
verification stay here so other services cannot accidentally depend on this
application's security contract.