Design a step-up authentication flow requiring extra verification (e.g., an OTP) only for high-value operations like a large fund transfer, without forcing re-login for everything.

Issue the initial JWT with a claim indicating the authentication 'level' achieved (e.g., acr or a custom step_up_verified claim). Sensitive endpoints use a @PreAuthorize expression checking that claim; if absent, the API returns a specific 'step-up required' response prompting the client to complete an additional OTP challenge, after which a new, elevated token (or an additional short-lived assertion) is issued permitting that specific high-value action.