In the “modeling gcp” blog post we allow granting access to the spanner service as a whole. Does that cover it? https://authzed.com/blog/google-cloud-iam-modeling