Set a member's role in a workspace (tenant admins only; a workspace admin grant does not manage grants)

Upserts the role. A grant on the default "All data" is stored but never narrows access there: every member opens the default with their organization role. Grants narrow only in other workspaces.