Rant: I'm glad the author called out GCP as well, but the idea that it's the user's fault for granting too many permissions is absurd. Has the author tried doing this at scale? Try a super simple example: I want a user to have access to query a schema in BigQuery. Can you guess the magic combo of permissions that is going to take? Because the documentation is not going to correctly tell you. Thus after spending way too much time trying to get it done one ends up widely over-permissioning to just get the damn thing to work. You could argue their model is sound and it's just that how they aggregated permissions into roles is absurd or even just argue that they need better defined roles and I would accept that, but still it's quite frustrating as is. I mean just look at the length of the reference: https://cloud.google.com/iam/docs/understanding-roles