Creates a custom role. With base_role_key the role starts with a copy of that role’s permission rules; the copy is independent — later changes to either role do not affect the other. Only the team owner may manage roles.
Optional. tenant_admin, tenant_member or a custom role key of this team: the new role starts with a copy of that role’s permission rules (later changes to either role do not affect the other). Omit for a role with no permissions. The owner role cannot be a base.
When true, only the team owner or a member holding the admin baseline — through their role or through an access group — may grant this role. A property of the role, the same for every caller; it is not the console role list’s per-caller assignable flag.
Whether member and invitation writes accept this role at all — the same for every caller. The owner role never is. Unlike the console’s role list, this does not say whether you yourself may grant it: for that, combine it with admin_grant_only and your own role.
For custom roles: the role whose permission rules were copied into this one when it was created. Absent on built-in roles and on custom roles created without a base.
Every permission the role grants, with its source. Returned only to callers holding policy:manage on tenant:policy; omitted for everyone else. An empty list means the role grants nothing. Instance limits (the role’s access scope) are not reflected here.
built_in: part of a built-in role’s definition. base_role: the base role grants it too — it was copied from the base role when this role was created. role_rule: granted only by this role’s own permission rules.
