Use escalate on roles to bypass the check that normally prevents writing permissions you do not already hold.
Create or update a Role granting arbitrary permissions in the namespace.
Activate it with a RoleBinding.
Creating or changing the binding still needs bind on the referenced Role, or the caller must already hold the referenced permissions.
Rights needed, any one set:
· all four; escalate writes the rules, bind permits referencing them
· editing an existing Role instead of creating one