Primitive roles are a legacy layer — almost never the right default.
Three role tiers, plus IAM Conditions for access that expires itself.
1
PrimitiveOwner/Editor/Viewer — Editor spans nearly every service, almost never used in production
2
PredefinedGoogle-maintained, scoped to one service — the default for almost every real grant
3
CustomExact permissions, but you maintain it — needs a named owner and review trigger
IAM Conditions attach a boolean expression to a binding — a time-bound grant expires automatically, closing the "temporary access that quietly became permanent" pattern with no human remembering step required.