Assign one or more workspace roles to an existing user by user_id (internal keycloak UUID — never say this to the user). Existing roles are preserved — new roles are added incrementally. Valid roles: OWNER, ADMIN, SUPER_CONNECTOR, SUPER_CONNECTOR_ADMIN, REQUESTER, TECHNICAL_ADMIN. Does NOT set email, name, phone, LinkedIn, or Super Connector category. Do NOT use to onboard new Super Connectors — add_super_connector creates the user, assigns the Super Connector role, and places them in a category in one call. USER-FACING COPY after success: e.g. 'Requester role has been assigned to Manthan.' — never say 'add_role', 'tool call', or enum strings like REQUESTER in user messages; use 'Requester', 'Admin', 'Super Connector'.

Use when: Use ONLY after the person exists in the workspace (typically after create_workspace_member for non-SC members). Do NOT call on add-member form submit. Do NOT use for new Super Connector onboarding — use add_super_connector instead. Do NOT assign SUPER_CONNECTOR via add_role when adding a new Super Connector. After assigning, confirm in plain language only — do not explain internal steps or tool names to the user.

workspace_id / user_id are injected from request headers.

Prerequisites (check before calling this tool): [REQUIRED] user_id (keycloak_user_id) must be known — typically from create_workspace_member response or search_workspace_members. Verify: For new members: call create_workspace_member first and use keycloak_user_id from the response. Do not call add_role with only a role and no user_id. Do not call add_role instead of create_workspace_member when the add-member form was submitted with email. [optional] Do not use add_role with SUPER_CONNECTOR to onboard a new Super Connector. Verify: If the user wants to add a Super Connector, use add_super_connector on form submit instead — it handles user creation, role assignment, and category placement.