Multi-Tenant LMS Authentication with Role-Based Access Control

Design a comprehensive JWT-based authentication strategy for a multi-tenant learning management system that supports granular role permissions across school districts. Create an API architecture that can dynamically handle student, teacher, administrator, and parent roles with nested permission hierarchies. Include detailed token generation logic that supports district-level isolation, implements refresh token mechanisms, and provides secure credential rotation every 90 days.