With that rule you are only adding claims to the ID token which is the token the client application validates and extracts user information from.
If the API that will be called with the access token will also need equivalent information you can update the rule to also perform the following:
context.accessToken[‘https://AuthSpa.com/roles’] = user.app_metadata.roles;
context.accessToken[‘https://AuthSpa.com/employeeid’] = user.app_metadata.employeeid || ‘na’;
The above includes the same two custom claims into the access token due to the use of context.accessToken. The API that validates this access token can then extract this information.