Invite a member into the tenant with an access matrix

Invites a new member into the TENANT and grants, in the same request, every row of its access matrix: the whole tenant, whole subscriptions, single projects, or any mix, each row with its own role. access: [] invites a member without access. The member is created INVITED; when sendInvitationEmail is true the invitation (sign-in link) is mailed after the commit. Validation: every row is checked BEFORE anything is written, and a refused invite leaves nothing behind (no user, invite, token, grant or Activity Log record). A row's scopeId must be this tenant, one of its subscriptions or a project beneath one of them AND be reached by the caller -- unknown, foreign and unreached are the same 404 (SCOPE_NOT_FOUND). The caller needs iam: manage at the row's own target (INSUFFICIENT_ROLE_FOR_SCOPE), must outrank and cover the role there (CANNOT_GRANT_ABOVE_OWN), and a tenant row needs an owner of the tenant (TENANT_OWNER_REQUIRED) -- all 403. An unknown role is ROLE_NOT_FOUND and a role not assignable at the row's kind ROLE_NOT_ASSIGNABLE_AT_SCOPE -- both 422. Every row is evaluated; the status is the highest of 404 > 403 > 422 and details.errors[] lists every row error of that status as {index, field: "access.<i>.<scopeId|role|scopeKind>", code, message}. Normalization: rows are compared on the canonical role id. An exact duplicate (DUPLICATE), a project row whose subscription has a row with the same role (COVERED_BY_SUBSCRIPTION) and any subscription/project row when a tenant row with the same role exists (COVERED_BY_TENANT) are dropped and returned in dropped. Different roles never cover each other. Async & state: 202 with the INVITED member (its roles and accessSummary) and the dropped rows. The Activity Log records iam.user.invite plus one iam.user.access.grant per written row. Errors: 401 unauthenticated; 403 when the caller has no iam: manage anywhere in the tenant or a row is refused; 404 when the tenant (or, for a bearer, a tenant other than its home tenant) or a row's scope is not reached; 409 when the address is already a member of this tenant; 422 on body or row validation failure (including a personalMessage over 500 characters or carrying a link); 429 RATE_LIMITED (details.reason INVITE_TENANT_DAILY_LIMIT) when the tenant has used today's invitation-mail budget. Idempotency/Concurrency: Idempotency-Key is required; a replay returns the original answer without a second invitation. An address that already has an account elsewhere is answered exactly like a fresh one.

Step-up: granting an owner-ranked role (built-in owner, or a custom role that ranks as owner) from a console session whose account has two-factor authentication needs the factor verified in the last 5 minutes, otherwise 403 MFA_STEP_UP_REQUIRED (verify with POST /auth/step-up, then retry). Other roles, and an owner row the member already holds, are not affected.