hello, Today, every user created through SSO gets the Artist role, and roles are never updated from the identity provider. A Studio Manager has to promote each user by hand, and changes made in the IdP are never reflected in Kitsu. Request: map an IdP claim (roles or groups) to Kitsu roles through configuration, for example Kitsu.Manager → Production Manager and Kitsu.Supervisor → Supervisor. Apply the mapping at account creation, or at every login (the IdP is authoritative). Set a default role when nothing matches, or refuse the login. Never grant Studio Manager through the mapping unless it is explicitly allowed. This makes the IdP the single source of truth for access rights and makes access reviews simpler.