This definitely seems like an improvement over the existing permissions system, but still seems to lack the granularity in resources to do things like per-bucket permissions in GCS.<p>It&#x27;s a little silly to have to give a machine full read access to GCS if it just needs to download some packages&#x2F;binaries but doesn&#x27;t need access to things like database backups.