Contributor role assigned at sub-dataverse level blocks accessed to contained datasets (even when Contributor role also assigned at dataset)

What steps does it take to reproduce the issue?
Create a sub-dataverse - do not publish.
Assign a user Contributor role at sub-dataverse.
Create one or more datasets in that sub-dataverse. Do not publish.
In dataverse ui, it looks like the contributor role for the dataset is inherited for the contained datasets.

User attempts to access sub-dataverse - they get the "Permission denied" error message.
User attempts to access the contained datasets - they get the "Permission denied" error message.

Assign the user Contributor role for each contained dataset.
User attempts to access sub-dataverse - still get "Permission denied" error message.

Remove the user's Contributor role at the sub-dataverse level (leave their Contributor role for the datasets).

User can access the dataset and Edit metadata and Ts&Cs and submit for review.

• When does this issue occur?
  When Contributor role is assigned at sub-dataverse level.

• Which page(s) does it occurs on?
  See above

• What happens?
  See above

• To whom does it occur (all users, curators, superusers)?
  Contributors assigned at sub-dataverse level

• What did you expect to happen?
  I would expect either:

1. As the UI seems to indicate that the Contributor role is inherited from the sub-dataverse, that assigning Contributor role at the sub-dataverse gives the user the Contributor role/permissions for the contained datasets. Certainly don't completely block access to the datasets.

Or:

2. If the Contributor role is only applicable to datasets, do not allow the Contributor role to be assigned at a sub-dataverse level and allow only for datasets.

Which version of Dataverse are you using?
6.3

Any related open or closed issues to this bug report?
Not sure.

Reproduce the scenario in Dataverse 6.3 by assigning Contributor at the sub-dataverse level, then compare access to the sub-dataverse and contained datasets with dataset-level assignments. Trace the authorization path for inherited Contributor permissions and define done as allowing the expected access or preventing the invalid role assignment, with regression coverage for both cases.