we're using the approach detailed here https://authzed.com/blog/google-cloud-iam-modeling to do something similar. the post isn't quite complete in the sense that the roles themselves would also need to be permissioned under the model, but that's absolutely something you can do.