docs: SSO roles are opt-in via roles_enabled

[devin-ai-integration]

Summary

SSO role-based access control is now opt-in per site: Fern only carries a visitor's SSO roles into their fern_token when roles are enabled for that site (roles_enabled), and configuring a roles_claim opts in on its own. Previously every SSO site got the default WorkOS member role, which forked the docs route cache into an un-warmed variant and made the first page load after login very slow (~30s). Sites that don't gate content by role now avoid that penalty; sites that do use RBAC need roles explicitly enabled, otherwise authenticated visitors carry no roles and see only everyone content.

Implements docs for: fix(docs): make SSO roles opt-in via roles_enabled (fern-api/fern-platform#13578)

Pages changed

• authentication/sso.mdx — the role-based access control steps now start with enabling roles for the site, and the closing paragraph notes that roles_claim also enables them while an explicit roles_enabled: false wins. Framed as something Fern configures with you, matching the rest of the page.
• authentication/rbac.mdx — one sentence in Setup pointing SSO readers at the SSO page's RBAC section.
• changelog/2026-08-03.mdx — new entry (security, performance).

Not done: self-hosted env vars

The task asked to document FERN_AUTH_ROLES_ENABLED / FERN_AUTH_ROLES_CLAIM in self-hosted/self-hosted-authentication.mdx. That page documents only password and basic_token_verification, and the self-hosted feature matrix in self-hosted/self-hosted.mdx currently lists both SSO and RBAC as unsupported. Documenting the vars would require adding an SSO section that contradicts that matrix, so I left it out. If self-hosted SSO is in fact supported, the matrix needs updating too and I'll add the section in a follow-up.

Validation

pre-commit run --files <changed> (Vale: 0 errors; remaining warnings are on pre-existing lines) and fern check --warnings (0 errors).

Link to Devin session: https://app.devin.ai/sessions/af65a60bcadd487f92197ece104d9c37

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

🌿 Preview your docs: https://fern-preview-devin-1785949688-sso-roles-opt-in.docs.buildwithfern.com/learn

Here are the markdown pages you've updated:

• learn/docs/authentication/features/rbac
• learn/docs/authentication/setup/sso
• learn/docs/changelog/2026/8/3