Replace a permission set's grants and description.

permissions is the complete new list, not a delta — anything you omit is removed. Every member of this organization assigned to the set has their effective permissions re-materialised as part of the request, so the change takes effect on those users’ next call rather than after a cache expiry.

Builtin sets (read-only, standard, admin) are immutable and refuse the write with 409, so those names always mean the same thing.

Note the asymmetry: writing a set needs settings:write, while reading one needs users:read.