A permission is never granted alone — only through a role.
Four precise terms describe how access ever reaches a resource: principal, permission, role, binding, policy.
PrincipalThe "who" — human, group, service account, federated identity
RoleA named bundle of permissions
BindingThis role, granted to this principal, at this resource
PolicyThe full set of bindings on one resource
Skipping a link in this chain is a common source of IAM confusion — a permission only ever reaches a principal bundled inside a role, and a role only ever reaches a resource through an explicit binding.
Best practice: grant roles to groups, never individuals — onboarding/offboarding becomes membership management, not an IAM-policy audit across every project a person ever touched.