D1 — Device and user isolation

One tenant (dev-b2b-admin). Device tokens and user tokens are different subjects on the same (or later, different) signing key. Mapping is not in the JWT.

Load tokens

D2 session_id (optional)

Device access token (Journey A)User access token (Journey B)