hallowed-rain-9096
It is how Google IAM API work. It is tricky and dangerous. And their docs are quite confusing