Assign the role to a principal at a scope

Grants this role to a principal (user or service account) at a chosen scope level ("Add assignment" in the role detail page assignments tab — choose a principal and scope). On acceptance the assignment appears in the role's assignment table (principal, type, scope type, scope) and in the principal's role list, and the role's member count increases. Validation: the role must exist and be visible (else 404 NOT_FOUND); principalId must reference an accessible user or service account in the tenant (unknown → 404 NOT_FOUND); scopeKind must be one of subscription|project and included in the role's assignableScopes; scopeId must reference an accessible subscription or project — violations → 422 VALIDATION_FAILED; an identical principal+scope assignment for this role already existing → 409 CONFLICT. Async & state: Asynchronous; returns 202 with an Operation (action iam.role.assignment.create) progressing PENDING → RUNNING → SUCCEEDED once the grant is written and propagated to enforcement points (FAILED on error). A resource.updated SSE frame with kind iam.role carries the updated member count; the new assignment row is then visible to subsequent reads. Errors: 401 unauthenticated; 403 when the caller lacks iam:manage at the target scope; 404 when the role or principal does not exist; 409 CONFLICT for a duplicate principal+scope assignment; 422 for an invalid scope kind, a scope level outside the role's assignableScopes, or an inaccessible scope reference; 500 on internal failure. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the original 202 Operation without granting twice. No If-Match applies to assignment creation.

Step-up: granting an owner-ranked role (built-in owner, or a custom role that ranks as owner) from a console session whose account has two-factor authentication needs the factor verified in the last 5 minutes, otherwise 403 MFA_STEP_UP_REQUIRED (verify with POST /auth/step-up, then retry). Other roles, and an owner row the member already holds, are not affected.