Custom roles and permission simulation
Define narrowly scoped permissions and inspect their effective grants before assignment.
Custom roles select named permissions for organization or project operations. They supplement built-in roles without introducing an implicit deny layer.
Define a role around a task
Create a role under Organization settings → Roles and select its allowed scope types. Choose permissions for the operational task, such as reading volumes and requesting backups without deleting source disks.
The editor lists prerequisite permissions. Reading operation results requires operation-read access in the relevant scope; permission to submit a change does not automatically reveal every organization operation. Guest Console, Guest Recovery, Recovery Override, and audit export are separate grants.
Bind and simulate
Assign the role to a team or service account at a project, selected region, or organization scope supported by the role. Open Simulate access, select a principal and resource ID, and choose an action.
The result identifies effective bindings, API-key scope if applicable, and policy conditions that can still reject the action. Simulation does not issue the operation or reserve capacity. A later request is evaluated again against its current target and configuration.
A narrower binding cannot subtract a broader grant. If a principal is an Organization Admin through another team, adding a read-only project role does not restrict that administrator access. Remove or change the broader binding.
Role revisions
Editing permissions creates a revision and shows affected principals before submission. Active bindings refer to the role's current revision. Removing a permission can cause an automation's next request to fail even while an earlier accepted operation continues.
For a production permission reduction, inspect active service-account workflows and the resources they can change. Revoke credentials as well when the intended outcome is to stop all new machine requests immediately.
Approval separation
A requester role can submit a maintenance plan while an approver role authorizes its protected actions. Configure self-approval policy independently. Neither role can bypass the resource's CPU, storage, fencing, or quota requirements.
Use a separate exception role for emergency recovery and assign it through the organization's time-limited access procedure. A reason field is evidence of the request, not an enforcement boundary by itself.
Retire a role
A role with active bindings cannot be deleted. Rebind affected principals or remove their grants, verify effective access, then delete the unused definition. Historical audit records retain the role ID and revision used for past actions.
Use roles and teams for built-in roles, API authentication for machine scope intersection, and maintenance approvals for protected change execution.