Grant (or replace) a role for a subject at a scope — requires M + no-escalation

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.