GrantPermisison.cs

Identity amit;
string projectName = "VSOnline";
Guid projectId;     
{
    ProjectHttpClient client = connection.GetClient<ProjectHttpClient>();
    var projects = client.GetProjects().SyncResult();
    projectId = projects.Single(s => StringComparer.OrdinalIgnoreCase.Equals(s.Name, projectName)).Id;
}

{
  WorkItemTrackingHttpClient witClient = connection.GetClient<WorkItemTrackingHttpClient>();
  var rootAreaId = witClient.GetClassificationNodeAsync(projectId, TreeStructureGroup.Areas, depth: 0).SyncResult().Identifier;

  Guid namespaceId = WitConstants.SecurityConstants.CommonStructureNodeSecurityNamespaceGuid;

  var securityToken = WitConstants.SecurityConstants.GetRootClassificationNodeToken(rootAreaId.ToString());

  int allow = WitConstants.SecurityConstants.AuthorizationCssNodePermissions.WorkItemRead |
              WitConstants.SecurityConstants.AuthorizationCssNodePermissions.WorkItemWrite;

  int deny = WitConstants.SecurityConstants.AuthorizationCssNodePermissions.Delete;

  SecurityHttpClient client = connection.GetClient<SecurityHttpClient>();

  client.SetAccessControlEntriesAsync(
          namespaceId,
          securityToken,
          new AccessControlEntry[]
          {
              new AccessControlEntry()
              {
                  Descriptor = amit.Descriptor,
                  Allow = allow,
                  Deny = deny
              }
          },
          merge: false).SyncResult();
}