Created

Validation failure: reserved prefix, invalid name, empty scopes, or a requested scope value that exists in no catalog. An UNKNOWN scope is 400, not 403 — existence is a property of the input, and 403 would assert the scope is real and merely ungrantable

Subset-rule violation (caller does not hold one or more requested scopes), or the caller is acting under a support-access impersonation session (impersonation-operation-forbidden). The second is a DISTINCT cause and not an authorization failure — the operator holds admin.tenant.role.create and is inside the tenant boundary. A role is a new privilege bundle that can be assigned later and outlives the consent window. It binds on SaaS deployments only (PRD §148): SaaS is the only place ANKATech operates a tenant belonging to somebody else. Branch on type, not on the status.

Role name already exists in tenant or collides with system role