Jake also recently released another blog post around custom roles with GCP IAM as example: https://authzed.com/blog/google-cloud-iam-modeling/