all permissions for a resource server using current access token 3. Keycloak checks permissions and returns array of permission 4. Client can use permissions to guard actions (hide buttons, guard routes, etc.) • No library support. Needs custom code in client. • Client can send additional data when requesting permissions Keycloak Authorization for .NET Developers Use User-Managed Access protocol extensions with Keycloak