Add custom claims with a post-login Action: namespace, setCustomClaim, deploy
Updated solution skillNew
Custom claims need a namespaced name, the right token target, and three steps people skip: deploy the Action, attach it to the login flow, and test with a fresh login. Not the full reference manual.