userRoles, err := oc.ListUserPermissions(ctx, &client.Session{
		Identity: client.Identity{
			Id: userId,
		},
	}, tenant, api.RolesNamespace)
	if err != nil {
		return nil, fmt.Errorf("%w '%s': %s", ErrGetExistingUserRoles, userId, err)
	}
	patch := make([]client.RelationshipPatch, len(userRoles)+1)
	sid := ory.EnsureTenantPrefix(tenant, userId)
	if !strings.HasPrefix(role, gorm.GlobalTenant+".") {
		role = ory.EnsureTenantPrefix(tenant, role)
	}

	// Exit early if we try to set the same role the user already has
	if len(userRoles) == 1 {
		rel := userRoles[0]
		if rel.Object == role && *rel.SubjectId == sid {
			return &rel, nil
		}
	}
	for i, userRole := range userRoles {
		relation := userRole
		patch[i] = client.RelationshipPatch{
			Action:        &PatchOpDelete,
			RelationTuple: &relation,
		}
		logger.Infof("Revoking role '%s' from user '%s'", userRole.GetObject(), userRole.GetSubjectId())
	}
	relationship := &client.Relationship{
		Namespace: api.RolesNamespace,
		Object:    role,
		Relation:  api.RoleMemberRelation,
		SubjectId: &sid,
	}
	patch[len(userRoles)] = client.RelationshipPatch{
		Action:        &PatchOpInsert,
		RelationTuple: relationship,
	}
	logger.Infof("Granting role '%s' to user '%s'", role, sid)

	if len(patch) > 0 {
		if err := pc.PatchPermissions(ctx, patch); err != nil {
			return nil, fmt.Errorf("%w: %s", ErrPatchPermissions, err)
		}
	}