Function denial_message 

pub fn denial_message(
    action: &str,
    caller: CallerRole,
    required: CallerRole,
) -> String

The message a caller sees when their role is too low for an action.

Names the action, both roles, the group that would grant the needed role, and the command to join it — including the part people lose an afternoon to, that a new group only takes effect in a new login session.