cf set-org-role USERNAME ORG ROLE [--client]
Treat USERNAME as the client-id of a (non-user) service account