Request groups scope for whynot OIDC role

workplans/RAILIANCE-WP-0006-workload-kv-access-lanes.md

@@ -191,6 +191,11 @@ subject; do not create an unbounded OIDC role.
 `workload-kv-read-whynot-design-npm-publish` policy, `ttl=15m`, and the approved
 browser/local CLI callback URIs.
 
+**2026-06-28:** Positive verification found the OIDC role was missing
+`oidc_scopes`, causing OpenBao login to fail with `groups claim not found`.
+Updated the live role and source CCR to request `openid`, `profile`, `email`,
+and `groups`, matching the platform-admin OIDC scope shape.
+
 ## T04 - Provision the KV path without exposing the token
 
 ```task