Five setup considerations easy to skip past.
Each earns a full chapter later — here's the first working model.
IAM rolesCreator gets Owner automatically — bind teammates to groups explicitly
APIsEnable explicitly per project, independent of IAM role
QuotasCap resource consumption per project/region
ObservabilityDefault workspace/bucket auto-created per project
NetworkingDefault VPC ships permissive — don't build prod on it
A PERMISSION_DENIED error on an otherwise correctly-permissioned call is very often actually an API enablement error — check
gcloud services list --enabled before touching IAM.