Decide what an agent changes in your token service

Your platform team owns the internal auth service that issues JWTs for 40 other services. This quarter it must do 2 things.

Refresh tokens must rotate on every use. And signing must move from one shared HS256 secret to RS256 keys, published at a JWKS endpoint (a URL where services fetch the public keys). The deadline is tight, and a teammate wants a coding agent to write all of it.

Do you agree? Decide what the agent may own, what it may only draft, and what you do differently for the security-critical parts.