put
https://api.qfp.quantnetwork.net/api/tenants//roles//permissions
Sets the role's grants to exactly the names given: a replacement, not
a merge, so a name left out is revoked and an empty array leaves the
role granting nothing. Requires role:update, and the path tenant
must equal the caller's tenant_id claim.
Only a custom role can be edited (a platform role is 400); another
tenant's role reads as 404. The containment rule applies to what is
newly granted: a permission the role already held stays whether
or not the editor holds it.