> such as asking a user to use 2FA for editing sensitive data if they haven't provided that information in the last 15 minutes

Can't you just use the iat claim to check for issuance time for this one?