Yep - more of a workaround than a fix though as it doesnt remove using assertion mapping.
use okta groups to manage adding the roles by assertion.
then use workflows to remove the role from the user when theyre removed from the okta group or added to a "remove X role group"
you can then use okta group rules to manage which users need to have what role removed and let workflows handle the work - be careful to watch the rate-limits. 🙂
Workflows is an 'extra' with Okta - but you can run five workflows without paying more (plenty for what you're wanting to do)
I'll come back in a bit with screenshots if needed.