role-assignments

Bulk-replace user role assignments (async). On Workday-managed tenants, each accepted mapping is also synced to Rolodex (role-only); a row is reported applied only once both Pilot and Rolodex accept. Evisort-managed tenants skip Rolodex. ACL endpoints require an admin (or super-admin) JWT and the LaunchDarkly flag public-acl-api-ekp-55221. Missing the flag or a non-admin caller → 403 FORBIDDEN.