It's not about "enforcing" anything, it's just about modeling what's actually there, in GCP IAM you can't say, "jake and joey are reader and writer on instance 1", you can only say "jake is reader and writer on instance 1" and then "joey is reader and writer on instance 1"