Another question - if i disable JWT verification, all this does is cause Cerbos to not verify the JWT signature using the kid claim right? i.e. against the well-known JWKS endpoint of the service that mints the JWT.

Correct

thanks!