and yes, I second this:

It is how Google IAM API work. It is tricky and dangerous. And their docs are quite confusing