this is a previous iteration that makes the opposite tradeoff: https://authzed.com/blog/google-cloud-iam-modeling#user-content-roles-and-role-bindings