# Diagnose: roles missing from token
## Symptom
Dashboard > User Management > Roles shows roles; the decoded access token has no `permissions` claim (and no roles claim; Auth0 does not emit a roles claim by default).
## Likely causes
1. API RBAC settings off: Applications > APIs > your API > Settings > "Enable RBAC" and "Add Permissions in the Access Token" are both required. Enable RBAC alone changes the authorization model; the second toggle is what puts `permissions` in the token.
2. Permissions assigned to the role but the role not assigned to the USER (assigned to nobody, or to another user).
3. Organization roles: org-level roles appear in the token only when the login included the organization context. A login without `organization` gets no org roles.
4. Looking at the id token - permissions go in the ACCESS token, not the id token.
5. Caching: the token was minted before the role assignment. Tokens are snapshots.
## Confirm
- Decode the access token (not the id token). Check `permissions` array and `scope`.
- Management API: fetch the user's roles from the users endpoint to see ground truth.
- Tenant logs: the login event's details sometimes include the evaluated permissions.
## Fix
Flip both RBAC toggles on the API, assign the role to the user, log in fresh. For org roles, ensure the authorize call passes the organization.
## Verify
Fresh token contains the expected `permissions` entries. Add a token-content assertion to your API's test suite.