Basic roles are a legacy layer — almost never the right default.
Policy inheritance is a strict union up the hierarchy, never a lower-level override.
1
BasicOwner/Editor/Viewer — Editor spans nearly every service, avoid outside a sandbox
2
PredefinedGoogle-maintained, scoped to one service — the default for almost every grant
3
CustomExact permissions, capped at 64 KB — you own the maintenance burden
A stray
roles/editor at the Organization node reaches every project, forever, until someone finds and removes that one binding — the union-only inheritance model makes basic roles dangerous. IAM Conditions add a CEL expression to any binding, the standard mechanism for access that expires itself.