The binding schema you pass to your IAM policy is just the GCP schema from here https://cloud.google.com/iam/docs/reference/rest/v1/Policy