Errors when granting or revoking a role

Symptom

• NOT_IN_TENANT: This email is not a member of this tenant.
• NOT_IN_ACCOUNT: This email is not a member of any tenant in this account.
• NOT_AT_THIS_TENANT: This assignment is not at this tenant's own scope; it cannot be revoked here. (in the account: NOT_AT_THIS_ACCOUNT)
• “This person already had this role; no new assignment was made.”
• NOT_A_BUILDER_HERE: This assignment is not a builder assignment at this account.

Cause

• A role is given only to someone who is already a member: in a tenant, to a member of this tenant; in the account, to a member of one of the account's tenants.
• A screen revokes only the assignments given in its own scope; a role that flows down from the scope above is revoked where it was given.
• The same role is not given to the same person twice.

Fix

1. If the person isn't a member, first add or invite them from the tenant's Members screen, then give the role.
2. If the assignment comes from another scope, check on the tenant's Access screen where it comes from, and ask that scope's administrator to revoke it.
3. If the role already exists, you don't need to do anything; you can see the person's keys on the Access screen.