Grant the member one access row

Adds ONE row. A no-op when the member already holds it or a row of the same role covers it (reported in dropped). The member's editable rows of the same role the new row covers are removed and returned in removed (an upgrade to a subscription or to the whole tenant). Single-row errors carry index: 0 and a field without the access.0. prefix. Rows are checked at their OWN target exactly as on the invite (POST /tenants/{tenantId}/iam/users): 404 SCOPE_NOT_FOUND; 403 INSUFFICIENT_ROLE_FOR_SCOPE / CANNOT_GRANT_ABOVE_OWN / TENANT_OWNER_REQUIRED; 422 ROLE_NOT_FOUND / ROLE_NOT_ASSIGNABLE_AT_SCOPE; precedence 404 > 403 > 422 with details.errors[{index, field, code, message}]. 409 details.reason: LAST_TENANT_OWNER (the change would leave the tenant without an owner) or SELF_IAM_MANAGE_REMOVAL (the caller would remove one of its own rows that confers iam: manage). Every added / removed row is one iam.user.access.grant / iam.user.access.revoke Activity Log record and re-projects the member's OpenStack roles. The answer is the full matrix after the change.

Step-up: granting an owner-ranked role (built-in owner, or a custom role that ranks as owner) from a console session whose account has two-factor authentication needs the factor verified in the last 5 minutes, otherwise 403 MFA_STEP_UP_REQUIRED (verify with POST /auth/step-up, then retry). Other roles, and an owner row the member already holds, are not affected.