Requires organization administration. Each item names a person, a workspace in the current region, and the role of the person there. A role adds a person without access, or changes the role of a person with access. null removes the person's access to the workspace: the role, the direct grants on resources inside it, the group memberships, the invitations and the assignments. API keys stay. A directory person gets an assignment, and any other person gets an invitation. The same role changes nothing, except on an expired invitation, which is sent again. For each person, additions and role changes run first. When one fails, the removals of that person are held. Items can fail while others succeed: the answer has one result for each item. Workspace owners, group-managed access and transfer_required entries cannot change here. A person whom a directory deactivated or deleted gets no invitation, and the customer lifts that refusal in the directory. A second send of the same request gives the same final state, and its items report unchanged. Two items for the same email and workspace answer 400.