{Role} carries {permission}, which applies to the whole organization and can't be given on a unit.
grant_unit_role