getDirectRolesForUser filtered on origin='direct', which excluded roles assigned via claim mapping (origin='managed'). This caused OIDC users to appear roleless even when claim mappings matched. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>