The roles-claim and default-roles fallback paths in applyClaimMappings were using assignRoleToUser (origin='direct'), causing OIDC-derived roles to accumulate across logins and never be cleared. Changed both to assignManagedRole (origin='managed') so all OIDC-assigned roles are cleared and re-evaluated on every login, same as claim mapping rules. Only roles assigned directly via the admin UI are preserved. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>