like if you're using something like the Google Cloud IAM blog's schema, you do need a separate role binding for every user + resource + role set, but you don't necessarily need separate roles for every role binding