Answer
Use a g line with the username: `g, alice, role:dev`. This is common for local accounts or when not using group claims. For SSO, binding groups scales better than individual users.
policy.csv: |
g, alice, role:devReal-world example A specific automation user 'alice' is bound directly to the dev role.