ObjectGrantRequest

Exactly one of group_id and user_id. role_ids are the roles the subject will have on the object; they replace the previous ones, and an empty list removes all of them.