Basically what this page suggests:
Auth0’s actions provide access to an authorization object on the event, which is documented to contain the roles assigned to the user. However, I need access to the permissions associated with the roles without using the API Management client.
authorization
event
roles