diff --git a/src/auth.ts b/src/auth.ts
index dafd980..c8fe237 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -99,9 +99,12 @@ export function mediaRoleFromClaims(claims: Record<string, any>): MediaRole {
   if (roles.includes("media-intelligence-editor")) return "editor";
   if (roles.includes("media-intelligence-viewer")) return "viewer";
 
-  if (roles.some((role) => /(^|[-_])(owner|admin)$/.test(role))) return "admin";
-  if (roles.some((role) => /(^|[-_])(operator|developer)$/.test(role))) return "editor";
-  if (roles.some((role) => /(^|[-_])viewer$/.test(role))) return "viewer";
+  const arrowstackRoles = roles.filter((role) =>
+    role.startsWith("arrowstack-") || role.startsWith("arrowstack_")
+  );
+  if (arrowstackRoles.some((role) => /(owner|admin)$/.test(role))) return "admin";
+  if (arrowstackRoles.some((role) => /(operator|developer)$/.test(role))) return "editor";
+  if (arrowstackRoles.some((role) => /viewer$/.test(role))) return "viewer";
 
   // Fail safe: authenticated users with no recognised mapping can read but not mutate.
   return "viewer";