we have a similar requirement because we're using a version of the google iam model that you can find in the blog post