Clarify that 42NA8 might show sub-commands (#348) (#350)

This came out of a discussion here

neo-technology/neo4j#31828 (comment)

---------

Co-authored-by: Louise Berglund <[email protected]>

Author: renetapopova

modules/ROOT/pages/errors/gql-errors/42NA8.adoc

@@ -3,6 +3,38 @@
 == Status description
 error: syntax error or access rule violation - invalid reference in command. Invalid reference in command `{ <<cmd>> }`.
 
+== Explanation
+
+This error occurs as the cause of other exceptions, for example, when you try to:
+
+* Grant or deny privileges to, or revoke privileges from, a role that does not exist.
+* Grant or deny privileges to, or revoke privileges from, a role to perform administration commands on a database that does not exist.
+* Revoke a role from a user in Cypher 25, where either the role or the user does not exist.
+In Cypher 5, this last example gives a notification instead, see xref:notifications/all-notifications.adoc#_neo_clientnotification_security_impossiblerevokecommand[Impossible revoke command].
+
+== Example scenario
+
+For example, given that `role1` exists but `role2` does not, try to grant a privilege to both roles:
+
+[source,cypher]
+----
+GRANT WRITE ON GRAPH * TO role1, role2
+----
+
+[source]
+----
+error: syntax error or access rule violation - invalid reference in command. Invalid reference in command `GRANT WRITE ON GRAPH * NODES * TO role2`.
+----
+
+The command returns an error with GQLSTATUS xref:errors/gql-errors/42001.adoc[42001] and a cause with this GQLSTATUS 42NA8 and the status description above.
+The cause has a subsequent cause with GQLSTATUS xref:errors/gql-errors/42N10.adoc[42N10].
+
+[NOTE]
+====
+The command in the status description might not be the exact command you typed.
+Internally, the Neo4j administration commands are separated into more specific sub-commands, and the Cypher shown corresponds to the sub-command that was executed when the error occurred.
+====
+
 ifndef::backend-pdf[]
 [discrete.glossary]
 == Glossary