Treat additive roles as a schema capability, not a row edit
When an authorization table stores one scalar role per scoped membership, “add role B while keeping role A” is a schema requirement, not an operational row edit. Inspect uniqueness constraints and downstream membership selectors before writing. An update replaces the old role; in…