kra-new/internal/security/README.md

Internal Security

This package owns the application's administrator JWT policy. It is kept inside internal because its claims, audience, issuer and password-version fields are KRA-specific security protocol, not a reusable JWT utility.

Generic stateless helpers may live in pkg, but admin token signing and verification stay here so other services cannot accidentally depend on this application's security contract.