Patch the subjects array of an existing RoleBinding to add the attacker.

The roleRef field is immutable, so the Role or ClusterRole it points at cannot be swapped for a more privileged one

Kubernetes applies the same escalation check as create, requiring bind on the referenced Role or ClusterRole, or already holding all of its permissions

Yields whatever that binding already grants, scoped to its namespace.

This is not an independent bypass of the escalation check