Just confirmed on a seperate 3.4 model and controller, the offering user *thinks* it has admin access to the offer, but the controller superadmin doesn't show any access at all.

After explicitly granting the offering user "admin" access to the offer, they're able to successfully grant access as expected:

1) Confirming the user thinks it has admin access to the offer, and show the "permission denied" error:

prod-synapse-chat-canonical-db@is-bastion-ps6:~$ juju show-offer postgresql --format yaml
juju-controller-34-production-ps6:admin/prod-synapse-chat-canonical-db.postgresql:
  description: |
    Charm to operate the PostgreSQL database on machines.
  access: admin
  endpoints:
    database:
      interface: postgresql_client
      role: provider
  users:
    admin:
      display-name: admin
      access: admin
    everyone@external:
      access: read
    prod-synapse-chat-canonical-db:
      access: admin

prod-synapse-chat-canonical-db@is-bastion-ps6:~$ juju grant prod-synapse-chat-canonical-k8s consume admin/prod-synapse-chat-canonical-db.postgresql
ERROR permission denied

2) Confirm controller superadmin thinks that the previous user has no explicit access over the offer:

juju-controller-34-production-ps6@is-bastion-ps6:~$ juju show-offer admin/prod-synapse-chat-canonical-db.postgresql --format yaml
juju-controller-34-production-ps6:admin/prod-synapse-chat-canonical-db.postgresql:
  description: |
    Charm to operate the PostgreSQL database on machines.
  access: admin
  endpoints:
    database:
      interface: postgresql_client
      role: provider
  users:
    admin:
      display-name: admin
      access: admin
    everyone@external:
      access: read

3) Grant the offering user "admin" access to the offer:

juju-controller-34-production-ps6@is-bastion-ps6:~$ juju grant prod-synapse-chat-canonical-db admin admin/prod-synapse-chat-canonical-db.postgresql

juju-controller-34-production-ps6@is-bastion-ps6:~$ juju show-offer admin/prod-synapse-chat-canonical-db.postgresql --format yaml
juju-controller-34-production-ps6:admin/prod-synapse-chat-canonical-db.postgresql:
  description: |
    Charm to operate the PostgreSQL database on machines.
  access: admin
  endpoints:
    database:
      interface: postgresql_client
      role: provider
  users:
    admin:
      display-name: admin
      access: admin
    everyone@external:
      access: read
    prod-synapse-chat-canonical-db:
      access: admin

4) Successfully grant consume access as the original user

prod-synapse-chat-canonical-db@is-bastion-ps6:~$ juju grant prod-synapse-chat-canonical-k8s consume admin/prod-synapse-chat-canonical-db.postgresql
prod-synapse-chat-canonical-db@is-bastion-ps6:~$ juju show-offer admin/prod-synapse-chat-canonical-db.postgresql --format yaml
juju-controller-34-production-ps6:admin/prod-synapse-chat-canonical-db.postgresql:
  description: |
    Charm to operate the PostgreSQL database on machines.
  access: admin
  endpoints:
    database:
      interface: postgresql_client
      role: provider
  users:
    admin:
      display-name: admin
      access: admin
    everyone@external:
      access: read
    prod-synapse-chat-canonical-db:
      access: admin
    prod-synapse-chat-canonical-k8s:
      access: consume