if the idea is that a profile is a bundle of permissions, and that profile should be attachable to some user and apply to some resource, i'd recommend giving this blog post a read: https://authzed.com/blog/google-cloud-iam-modeling