Change someone's role in one workspace of the organization.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. Not the owner's role (409 owner_role); not in a closed workspace (409 workspace_closed). An admin's choice replaces the identity provider's group mapping for that person from then on.