Answer
Add a g line binding the group to role:admin in the policy: `g, <group>, role:admin`. The group name must match the claim from SSO (per the scopes setting). This grants that group full ArgoCD access.
policy.csv: |
g, platform-admins, role:adminReal-world example The platform-admins SSO group is bound to role:admin so its members manage all of ArgoCD.