Designing for Security and Compliance

Basic roles (Owner, Editor, Viewer: broad, avoid in production), predefined roles (service-specific, managed by Google), and custom roles (a user-defined set of permissions).

They grant thousands of permissions across all services, violating least privilege. Predefined or custom roles scoped to needs are preferred.

When no predefined role matches the needed permissions without granting excess. Custom roles must be maintained as services add permissions, and they can be defined at organization or project level.

Group membership changes (joiners, movers, leavers) are managed in one place, policies stay small and auditable, and access maps to job functions.

Allow policies are inherited downward: a role granted at the organization or folder applies to all projects and resources below. A lower-level allow policy cannot remove an inherited grant.

Use IAM deny policies, which are evaluated before allow policies and can deny specific permissions to principals (with exceptions) at organization, folder, or project level.