docs: document roles_claim for WorkOS SSO RBAC

[devin-ai-integration]

Summary

Documents the new optional roles_claim field on the WorkOS SSO auth config, added in fern-platform#13195. WorkOS SSO already surfaces the user's roles for RBAC; roles_claim lets a site source those roles from a custom access-token claim (e.g. a directory-group claim) instead of the default WorkOS organization role.

• authentication/sso.mdx: replaced the vague "tell Fern which claim to parse" sentence in the existing "Role-based access control" section with the concrete field name and behavior, plus a <ParamField>:

  Fern reads the WorkOS organization role by default. To source roles from a different token claim instead, set roles_claim ... Fern parses that claim from the WorkOS access token, accepting either an array of role slugs or a space-delimited string.

  <ParamField path="roles_claim" type="string" default="WorkOS organization role">
    The WorkOS access token claim to parse for roles. When omitted, roles come from the WorkOS organization role.
  </ParamField>

• changelog/2026-07-21.mdx: new changelog entry (tag security) for the custom roles claim.

Field name, default, and array/space-delimited parsing verified against packages/commons/docs-auth/src/types.ts and extract-roles.ts in fern-platform#13195. EN pages only; no translations touched.

Validation

• pre-commit run --files ... (Vale): passed, 0 errors/warnings.
• fern check --warnings: 0 errors (remaining warnings are pre-existing and unrelated).

Link to Devin session: https://app.devin.ai/sessions/0094ee90e65a48e09b997ae61522c82b

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

🌿 Preview your docs: https://fern-preview-devin-1784654155-workos-roles-claim.docs.buildwithfern.com/learn

Here are the markdown pages you've updated:

• learn/docs/authentication/setup/sso
• learn/docs/changelog/2026/7/21