A permission never reaches a resource except through a role.

GCP evaluates effective permissions as the union of every applicable binding — no explicit-deny-wins default. A separate Deny policy mechanism exists specifically for when you need to block access regardless of an allow policy elsewhere.