CustomClaims in ID Token not available in first login

Thank you for the reply
I did end up figuring it out for my specific use case and yes I had to run them under one Action

 if(event.authorization){
    if (event.stats.logins_count === 1) {
        api.idToken.setCustomClaim("rolesArray", [<default role>]);
      } else {
        api.idToken.setCustomClaim("rolesArray", event.authorization.roles);
        console.log(event.authorization.roles);
      }
  }

although a little unrelated, I was thinking of adding the same email sign-up prevention in this action too to prevent sign-up in case there is already a user with that same email(from either native login or google-oauth). Although I can prevent the sign up but the account still gets made
this is the existing code for that:

   management.getUsers({q: `email:"${event.user.email}"` },function (err, users) {
    if (users.length >= 1) {
     event.user.user_id
     
      api.access.deny("The user with this email already exists");
    }
  });