Grant users access to the single tenantID in the request. For entries identified by user ID, nonexistent users and users already holding tenant roles are skipped; this is not a role-replacement operation. Email entries can resolve or create users. Returned userIDs describe processed grants, not necessarily every input. A failure can occur after earlier entries have changed; inspect current access before retrying and do not assume an all-or-nothing batch.

A failed response does not contain a completed-users list. Invitation delivery is separate from access grants; success does not confirm invitation delivery.