Assuming you have middleware that validates your JWT and sets claims on some type of user principal in memory before processing the rest of the api, why not jus

Assuming you have middleware that validates your JWT and sets claims on some type of user principal in memory before processing the rest of the api, why not just create the restricted claim in the middleware if there is no auth bearer in the request?