Custom authorization rules

A company exposes APIs to external customers. Authentication is performed through a third-party identity provider that issues JWT tokens. The organization also requires custom authorization rules beyond standard claims validation. The API receives heavy traffic and must minimize latency and Lambda costs.

Which approach BEST satisfies these requirements?