@stocky-spoon-28903 @tall-librarian-49374 you're right, I have confirmed the behavior you described. The gcloud cli and webui allows for adding/removing single bindings regardless of whether an existing policy exists. Do you think it would make sense for pulumi to provide the same convenience? If so, I'll create an issue for it.