extractRoles() only handled List claims (JSON arrays). When rolesClaim is configured as "scope", the JWT value is a space-delimited string, which was silently returning [] and falling back to defaultRoles. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>