docs: SSO roles are opt-in via roles_enabled

fern/products/docs/pages/authentication/rbac.mdx

@@ -39,6 +39,8 @@ roles:
 
 Every user automatically has the `everyone` role, including unauthenticated visitors. When an unauthenticated visitor requests a gated page, Fern redirects them to your login flow and returns them to the requested page after they authenticate. An authenticated user who lacks the required role sees a 404 page. There is no limit on the number of roles you can define, unless you're using [password protection](/learn/docs/authentication/setup/password-protection), which supports up to three.
 
+[SSO](/learn/docs/authentication/setup/sso#role-based-access-control) sites also require roles to be enabled for the site. Without that, authenticated visitors carry no roles and see only content gated to `everyone`.
+
 ## Restricting content
 
 Once RBAC is configured, use `viewers` in your navigation and the `<If />` component in your pages to control what each role can see.

fern/products/docs/pages/authentication/sso.mdx

@@ -46,6 +46,10 @@ SSO can gate content by role. Fern reads each user's roles from the WorkOS token
 Fern's SSO runs on [WorkOS](/learn/docs/getting-started/how-it-works), so roles are assigned through your WorkOS organization. Fern coordinates this setup with you.
 
 <Steps>
+<Step title="Ask Fern to enable roles">
+Roles are off by default (`roles_enabled`). Until they're enabled for your site, every authenticated user carries no roles and sees only content gated to `everyone`.
+</Step>
+
 <Step title="Enable Organization Roles in WorkOS">
 Turn on Organization Roles (RBAC) for your organization, then define a role for each audience you gate content for (for example, `admins` or `partners`). Each role's slug is the value Fern reads from the token.
 </Step>
@@ -62,4 +66,4 @@ List the WorkOS role slugs under `roles` in `docs.yml`, then gate navigation and
 </Step>
 </Steps>
 
-Fern reads the organization role by default. To read roles from a different token claim instead (for example, a directory-group claim), tell Fern which claim to parse.
+Fern reads the organization role by default. To read roles from a different token claim instead (for example, a directory-group claim), tell Fern which claim to parse. Configuring that claim (`roles_claim`) enables roles on its own, unless `roles_enabled` is explicitly set to `false`, which always wins.

fern/products/docs/pages/changelog/2026-08-03.mdx

@@ -0,0 +1,7 @@
+## SSO roles are now opt-in
+
+<ChangelogTags>security, performance</ChangelogTags>
+
+SSO sites now carry roles into the `fern_token` only when roles are enabled for the site. Sites that gate content by role need roles enabled, otherwise every authenticated visitor sees only content gated to `everyone`. Sites that don't use role-gated content get faster first page loads after login. Configuring a roles claim also enables roles.
+
+<Button intent="none" outlined rightIcon="arrow-right" href="/learn/docs/authentication/setup/sso#role-based-access-control">Read the docs</Button>