Add member

Adding someone to the organization and choosing what they can do is one step, not two. Role is required — there is no "add now, decide later" path that leaves a person in the org with undefined access.

Contract. POST /v1/security/tenants/{tenantId}/members (MemberCreate → 201 Member). Role options are rendered from GET /v1/security/tenants/{tenantId}/roles — never hard-coded. The three shown (admin/editor/viewer) are today's catalogue, not a fixed list.

Fail-closed — an empty role catalogue is not an empty form. The roles endpoint returns { items: [] } both when a tenant genuinely has no roles and when the policy engine is unreachable. This form must never render zero role options and stay submittable: if items is empty, disable submit and show the error state in frame (e). Silently adding a person with no role is the failure this rule exists to prevent.