Answer
Workflows can only call REST/OData projection actions — they can't call a PL/SQL method like SECURITY_SYS.Is_Role_Granted directly. First check whether an existing standard projection action already exposes equivalent role-check functionality; if not, build a small custom projection action that wraps the PL/SQL call (e.g. calling SECURITY_SYS.Is_Role_Granted internally and returning the result), and call that custom projection action from your Validation-type workflow instead — the workflow interacts with your wrapper API over REST, the same way it would with any other projection action.