# BigQuery IAM roles and permissions This document provides a list of Identity and Access Management (IAM) predefined roles and permissions for BigQuery. This page includes roles and permissions for the following: - BigQuery: Roles and permissions that apply to BigQuery resources such as datasets, tables, views, and routines. Many of these roles and permissions can also be granted to Resource Manager resources like projects, folders, and organizations. - BigQuery Connection API: Role that grants a [service agent](https://docs.cloud.google.com/iam/docs/service-agents) access to a Cloud SQL connection. - BigQuery Continuous Query: Role that grants a [service account](https://docs.cloud.google.com/iam/docs/service-account-overview) access to a continuous query. - BigQuery Data Policy: Roles and permissions that apply to Data Policies in BigQuery. - BigQuery Data Transfer Service: Role that grants a [service agent](https://docs.cloud.google.com/iam/docs/service-agents) access to create jobs that transfer data. - BigQuery Engine for Apache Flink: Roles and permissions that apply to BigQuery Engine for Apache Flink resources. - BigQuery Migration Service API: Roles and permissions that apply to BigQuery Migration Service resources. - BigQuery Omni: Role that grants a [service agent](https://docs.cloud.google.com/iam/docs/service-agents) access to tables. - BigQuery sharing: Roles and permissions that apply to BigQuery sharing resources. ## BigQuery predefined IAM roles The following tables list the predefined BigQuery IAM roles with a corresponding list of all the [permissions](https://docs.cloud.google.com/bigquery/docs/access-control#bq-permissions) each role includes. Note that each permission is applicable to a particular resource type. > [!NOTE] > **Note:** When new capabilities are added to BigQuery, new permissions might be added to predefined IAM roles, and new predefined IAM roles might be added to BigQuery. If your organization requires role definitions to remain unchanged, you should create [custom IAM roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles). ### BigQuery roles This table lists the predefined IAM roles and permissions for BigQuery. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). For information on granting predefined roles on BigQuery resources like datasets, tables, and routines, see [Control access to resources with IAM](https://docs.cloud.google.com/bigquery/docs/control-access-to-resources-iam). | Role | Permissions | |---|---| | #### BigQuery Admin (`roles/bigquery.admin`) Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project. It is possible to grant this role to the following lowest-level resources, but it is not recommended. Other predefined roles grant full permissions over these resources and are less permissive. BigQuery Admin is typically granted at the project level. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Table - View - Routine - Connection - Saved query - Data canvas - Pipeline - Data preparation - Repository This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.bireservations.*` - `bigquery.bireservations.get` - `bigquery.bireservations.update` `bigquery.capacityCommitments.*` - `bigquery.capacityCommitments.create` - `bigquery.capacityCommitments.delete` - `bigquery.capacityCommitments.get` - `bigquery.capacityCommitments.list` - `bigquery.capacityCommitments.update` `bigquery.config.*` - `bigquery.config.get` - `bigquery.config.update` `bigquery.connections.*` - `bigquery.connections.create` - `bigquery.connections.delegate` - `bigquery.connections.delete` - `bigquery.connections.get` - `bigquery.connections.getIamPolicy` - `bigquery.connections.list` - `bigquery.connections.setIamPolicy` - `bigquery.connections.update` - `bigquery.connections.updateTag` - `bigquery.connections.use` `bigquery.dataPolicies.attach` `bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update` `bigquery.datasets.*` - `bigquery.datasets.create` - `bigquery.datasets.createTagBinding` - `bigquery.datasets.delete` - `bigquery.datasets.deleteTagBinding` - `bigquery.datasets.get` - `bigquery.datasets.getIamPolicy` - `bigquery.datasets.link` - `bigquery.datasets.listEffectiveTags` - `bigquery.datasets.listSharedDatasetUsage` - `bigquery.datasets.listTagBindings` - `bigquery.datasets.setIamPolicy` - `bigquery.datasets.update` - `bigquery.datasets.updateTag` `bigquery.jobs.*` - `bigquery.jobs.create` - `bigquery.jobs.createGlobalQuery` - `bigquery.jobs.delete` - `bigquery.jobs.get` - `bigquery.jobs.list` - `bigquery.jobs.listAll` - `bigquery.jobs.listExecutionMetadata` - `bigquery.jobs.update` `bigquery.models.*` - `bigquery.models.create` - `bigquery.models.delete` - `bigquery.models.export` - `bigquery.models.getData` - `bigquery.models.getMetadata` - `bigquery.models.list` - `bigquery.models.updateData` - `bigquery.models.updateMetadata` - `bigquery.models.updateTag` `bigquery.objectRefs.*` - `bigquery.objectRefs.read` - `bigquery.objectRefs.write` `bigquery.propertyGraphs.*` - `bigquery.propertyGraphs.create` - `bigquery.propertyGraphs.delete` - `bigquery.propertyGraphs.get` - `bigquery.propertyGraphs.list` - `bigquery.propertyGraphs.update` `bigquery.readsessions.*` - `bigquery.readsessions.create` - `bigquery.readsessions.getData` - `bigquery.readsessions.update` `bigquery.reservationAssignments.*` - `bigquery.reservationAssignments.create` - `bigquery.reservationAssignments.delete` - `bigquery.reservationAssignments.list` - `bigquery.reservationAssignments.search` `bigquery.reservationGroups.*` - `bigquery.reservationGroups.create` - `bigquery.reservationGroups.delete` - `bigquery.reservationGroups.get` - `bigquery.reservationGroups.list` - `bigquery.reservationGroups.update` `bigquery.reservations.*` - `bigquery.reservations.create` - `bigquery.reservations.delete` - `bigquery.reservations.get` - `bigquery.reservations.getIamPolicy` - `bigquery.reservations.list` - `bigquery.reservations.listFailoverDatasets` - `bigquery.reservations.setIamPolicy` - `bigquery.reservations.update` - `bigquery.reservations.use` `bigquery.routines.*` - `bigquery.routines.create` - `bigquery.routines.delete` - `bigquery.routines.get` - `bigquery.routines.list` - `bigquery.routines.update` - `bigquery.routines.updateTag` `bigquery.rowAccessPolicies.create` `bigquery.rowAccessPolicies.delete` `bigquery.rowAccessPolicies.get` `bigquery.rowAccessPolicies.getIamPolicy` `bigquery.rowAccessPolicies.list` `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions` `bigquery.rowAccessPolicies.setIamPolicy` `bigquery.rowAccessPolicies.update` `bigquery.savedqueries.*` - `bigquery.savedqueries.create` - `bigquery.savedqueries.delete` - `bigquery.savedqueries.get` - `bigquery.savedqueries.list` - `bigquery.savedqueries.update` `bigquery.tables.*` - `bigquery.tables.create` - `bigquery.tables.createIndex` - `bigquery.tables.createSnapshot` - `bigquery.tables.createTagBinding` - `bigquery.tables.delete` - `bigquery.tables.deleteIndex` - `bigquery.tables.deleteSnapshot` - `bigquery.tables.deleteTagBinding` - `bigquery.tables.export` - `bigquery.tables.get` - `bigquery.tables.getData` - `bigquery.tables.getIamPolicy` - `bigquery.tables.list` - `bigquery.tables.listEffectiveTags` - `bigquery.tables.listTagBindings` - `bigquery.tables.replicateData` - `bigquery.tables.restoreSnapshot` - `bigquery.tables.setCategory` - `bigquery.tables.setColumnDataPolicy` - `bigquery.tables.setIamPolicy` - `bigquery.tables.update` - `bigquery.tables.updateData` - `bigquery.tables.updateIndex` - `bigquery.tables.updateTag` `bigquery.transfers.*` - `bigquery.transfers.get` - `bigquery.transfers.update` `bigquerymigration.translation.translate` `cloudkms.keyHandles.*` - `cloudkms.keyHandles.create` - `cloudkms.keyHandles.get` - `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `dataform.*` - `dataform.commentThreads.create` - `dataform.commentThreads.delete` - `dataform.commentThreads.get` - `dataform.commentThreads.list` - `dataform.commentThreads.update` - `dataform.comments.create` - `dataform.comments.delete` - `dataform.comments.get` - `dataform.comments.list` - `dataform.comments.update` - `dataform.compilationResults.create` - `dataform.compilationResults.get` - `dataform.compilationResults.list` - `dataform.compilationResults.query` - `dataform.config.get` - `dataform.config.update` - `dataform.folders.addContents` - `dataform.folders.create` - `dataform.folders.delete` - `dataform.folders.deleteTree` - `dataform.folders.get` - `dataform.folders.getIamPolicy` - `dataform.folders.move` - `dataform.folders.queryContents` - `dataform.folders.setIamPolicy` - `dataform.folders.update` - `dataform.locations.get` - `dataform.locations.list` - `dataform.operations.cancel` - `dataform.operations.delete` - `dataform.operations.get` - `dataform.operations.list` - `dataform.releaseConfigs.create` - `dataform.releaseConfigs.delete` - `dataform.releaseConfigs.get` - `dataform.releaseConfigs.list` - `dataform.releaseConfigs.update` - `dataform.repositories.commit` - `dataform.repositories.computeAccessTokenStatus` - `dataform.repositories.create` - `dataform.repositories.createTagBinding` - `dataform.repositories.delete` - `dataform.repositories.deleteTagBinding` - `dataform.repositories.fetchHistory` - `dataform.repositories.fetchRemoteBranches` - `dataform.repositories.get` - `dataform.repositories.getIamPolicy` - `dataform.repositories.list` - `dataform.repositories.listEffectiveTags` - `dataform.repositories.listTagBindings` - `dataform.repositories.move` - `dataform.repositories.queryDirectoryContents` - `dataform.repositories.readFile` - `dataform.repositories.scheduleRelease` - `dataform.repositories.scheduleWorkflow` - `dataform.repositories.setIamPolicy` - `dataform.repositories.update` - `dataform.teamFolders.create` - `dataform.teamFolders.delete` - `dataform.teamFolders.deleteTree` - `dataform.teamFolders.get` - `dataform.teamFolders.getIamPolicy` - `dataform.teamFolders.setIamPolicy` - `dataform.teamFolders.update` - `dataform.workflowConfigs.create` - `dataform.workflowConfigs.delete` - `dataform.workflowConfigs.get` - `dataform.workflowConfigs.list` - `dataform.workflowConfigs.update` - `dataform.workflowInvocations.cancel` - `dataform.workflowInvocations.create` - `dataform.workflowInvocations.delete` - `dataform.workflowInvocations.get` - `dataform.workflowInvocations.list` - `dataform.workflowInvocations.query` - `dataform.workspaces.commit` - `dataform.workspaces.create` - `dataform.workspaces.delete` - `dataform.workspaces.fetchFileDiff` - `dataform.workspaces.fetchFileGitStatuses` - `dataform.workspaces.fetchGitAheadBehind` - `dataform.workspaces.get` - `dataform.workspaces.getIamPolicy` - `dataform.workspaces.installNpmPackages` - `dataform.workspaces.list` - `dataform.workspaces.makeDirectory` - `dataform.workspaces.moveDirectory` - `dataform.workspaces.moveFile` - `dataform.workspaces.pull` - `dataform.workspaces.push` - `dataform.workspaces.queryDirectoryContents` - `dataform.workspaces.readFile` - `dataform.workspaces.removeDirectory` - `dataform.workspaces.removeFile` - `dataform.workspaces.reset` - `dataform.workspaces.searchFiles` - `dataform.workspaces.setIamPolicy` - `dataform.workspaces.writeFile` `dataplex.datascans.*` - `dataplex.datascans.cancel` - `dataplex.datascans.create` - `dataplex.datascans.delete` - `dataplex.datascans.get` - `dataplex.datascans.getData` - `dataplex.datascans.getIamPolicy` - `dataplex.datascans.list` - `dataplex.datascans.run` - `dataplex.datascans.setIamPolicy` - `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list` `dataplex.projects.search` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Connection Admin (`roles/bigquery.connectionAdmin`) Lowest-level resources where you can grant this role: - Connection This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.connections.*` - `bigquery.connections.create` - `bigquery.connections.delegate` - `bigquery.connections.delete` - `bigquery.connections.get` - `bigquery.connections.getIamPolicy` - `bigquery.connections.list` - `bigquery.connections.setIamPolicy` - `bigquery.connections.update` - `bigquery.connections.updateTag` - `bigquery.connections.use` | | #### BigQuery Connection User (`roles/bigquery.connectionUser`) Lowest-level resources where you can grant this role: - Connection This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.connections.get` `bigquery.connections.getIamPolicy` `bigquery.connections.list` `bigquery.connections.use` | | #### BigQuery Data Editor (`roles/bigquery.dataEditor`) When granted on a dataset, this role grants these permissions: - Get metadata and permissions for the dataset. - For tables and views: - Create, update, get, list, and delete the dataset's tables and views. - Read (query), export, replicate, and update table data. - Create, update, and delete indexes. - Create and restore snapshots. - All permissions for the dataset's routines and models. > [!NOTE] > **Note:** Principals that are granted the Data Editor role at the project level can also create new datasets and list datasets in the project that they have access to. When granted on a table or view, this role grants these permissions: - Get metadata, update metadata, get access controls, and delete the table or view. - Get (query), export, replicate, and update table data. - Create, update, and delete indexes. - Create and restore snapshots. - All permissions for the routine. The Data Editor role cannot be granted to individual models. > [!NOTE] > **Note:** The BigQuery Data Editor role is mapped to the [`WRITER`](https://docs.cloud.google.com/bigquery/docs/access-control-basic-roles#dataset-basic-roles) BigQuery basic role. When you grant the BigQuery Data Editor role to a principal at the dataset level, the principal is granted `WRITER` access to the dataset. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Table - View - Routine This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.config.get` `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.datasets.updateTag` `bigquery.models.*` - `bigquery.models.create` - `bigquery.models.delete` - `bigquery.models.export` - `bigquery.models.getData` - `bigquery.models.getMetadata` - `bigquery.models.list` - `bigquery.models.updateData` - `bigquery.models.updateMetadata` - `bigquery.models.updateTag` `bigquery.propertyGraphs.*` - `bigquery.propertyGraphs.create` - `bigquery.propertyGraphs.delete` - `bigquery.propertyGraphs.get` - `bigquery.propertyGraphs.list` - `bigquery.propertyGraphs.update` `bigquery.routines.*` - `bigquery.routines.create` - `bigquery.routines.delete` - `bigquery.routines.get` - `bigquery.routines.list` - `bigquery.routines.update` - `bigquery.routines.updateTag` `bigquery.tables.create` `bigquery.tables.createIndex` `bigquery.tables.createSnapshot` `bigquery.tables.delete` `bigquery.tables.deleteIndex` `bigquery.tables.export` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.getIamPolicy` `bigquery.tables.list` `bigquery.tables.replicateData` `bigquery.tables.restoreSnapshot` `bigquery.tables.update` `bigquery.tables.updateData` `bigquery.tables.updateIndex` `bigquery.tables.updateTag` `cloudkms.keyHandles.*` - `cloudkms.keyHandles.create` - `cloudkms.keyHandles.get` - `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `dataplex.datascans.cancel` `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Data Owner (`roles/bigquery.dataOwner`) When granted on a dataset, this role grants these permissions: - All permissions for the dataset and for all of the resources within the dataset: tables and views, models, and routines. > [!NOTE] > **Note:** Principals that are granted the Data Owner role at the project level can also create new datasets and list datasets in the project that they have access to. When granted on a table or view, this role grants these permissions: - All permissions for the table or view. - All permissions for row access policies except permission to override time travel restrictions. - Set categories and column-level data policies. When granted on a routine, this role grants these permissions: - All permissions for the routine. You shouldn't grant the Data Owner role at the routine level. Data Editor also grants all permissions for the routine and is a less permissive role. This role cannot be granted to individual models. > [!NOTE] > **Note:** The BigQuery Data Owner role is mapped to the [`OWNER`](https://docs.cloud.google.com/bigquery/docs/access-control-basic-roles#dataset-basic-roles) BigQuery basic role. When you grant the BigQuery Data Owner role to a principal at the dataset level, the principal is granted `OWNER` access to the dataset. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Table - View - Routine This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.config.get` `bigquery.dataPolicies.attach` `bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update` `bigquery.datasets.*` - `bigquery.datasets.create` - `bigquery.datasets.createTagBinding` - `bigquery.datasets.delete` - `bigquery.datasets.deleteTagBinding` - `bigquery.datasets.get` - `bigquery.datasets.getIamPolicy` - `bigquery.datasets.link` - `bigquery.datasets.listEffectiveTags` - `bigquery.datasets.listSharedDatasetUsage` - `bigquery.datasets.listTagBindings` - `bigquery.datasets.setIamPolicy` - `bigquery.datasets.update` - `bigquery.datasets.updateTag` `bigquery.models.*` - `bigquery.models.create` - `bigquery.models.delete` - `bigquery.models.export` - `bigquery.models.getData` - `bigquery.models.getMetadata` - `bigquery.models.list` - `bigquery.models.updateData` - `bigquery.models.updateMetadata` - `bigquery.models.updateTag` `bigquery.propertyGraphs.*` - `bigquery.propertyGraphs.create` - `bigquery.propertyGraphs.delete` - `bigquery.propertyGraphs.get` - `bigquery.propertyGraphs.list` - `bigquery.propertyGraphs.update` `bigquery.routines.*` - `bigquery.routines.create` - `bigquery.routines.delete` - `bigquery.routines.get` - `bigquery.routines.list` - `bigquery.routines.update` - `bigquery.routines.updateTag` `bigquery.rowAccessPolicies.create` `bigquery.rowAccessPolicies.delete` `bigquery.rowAccessPolicies.get` `bigquery.rowAccessPolicies.getIamPolicy` `bigquery.rowAccessPolicies.list` `bigquery.rowAccessPolicies.setIamPolicy` `bigquery.rowAccessPolicies.update` `bigquery.tables.*` - `bigquery.tables.create` - `bigquery.tables.createIndex` - `bigquery.tables.createSnapshot` - `bigquery.tables.createTagBinding` - `bigquery.tables.delete` - `bigquery.tables.deleteIndex` - `bigquery.tables.deleteSnapshot` - `bigquery.tables.deleteTagBinding` - `bigquery.tables.export` - `bigquery.tables.get` - `bigquery.tables.getData` - `bigquery.tables.getIamPolicy` - `bigquery.tables.list` - `bigquery.tables.listEffectiveTags` - `bigquery.tables.listTagBindings` - `bigquery.tables.replicateData` - `bigquery.tables.restoreSnapshot` - `bigquery.tables.setCategory` - `bigquery.tables.setColumnDataPolicy` - `bigquery.tables.setIamPolicy` - `bigquery.tables.update` - `bigquery.tables.updateData` - `bigquery.tables.updateIndex` - `bigquery.tables.updateTag` `cloudkms.keyHandles.*` - `cloudkms.keyHandles.create` - `cloudkms.keyHandles.get` - `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `dataplex.datascans.*` - `dataplex.datascans.cancel` - `dataplex.datascans.create` - `dataplex.datascans.delete` - `dataplex.datascans.get` - `dataplex.datascans.getData` - `dataplex.datascans.getIamPolicy` - `dataplex.datascans.list` - `dataplex.datascans.run` - `dataplex.datascans.setIamPolicy` - `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Data Viewer (`roles/bigquery.dataViewer`) When granted on a dataset, this role grants these permissions: - Get metadata and permissions for the dataset. - List a dataset's tables, views, and models. - Get metadata and access controls for the dataset's tables and views. - Get (query), replicate, and export table data and create snapshots. - List and invoke the dataset's routines. When granted on a table or view, this role provides these permissions: - Get metadata and access controls for the table or view. - Get (query), export, and replicate table data. - Create snapshots. When granted on a routine, this role grants these permissions: - In a query, reference a routine created by someone else. This role cannot be granted to individual models. > [!NOTE] > **Note:** The BigQuery Data Viewer role is mapped to the [`READER`](https://docs.cloud.google.com/bigquery/docs/access-control-basic-roles#dataset-basic-roles) BigQuery basic role. When you grant the BigQuery Data Viewer role to a principal at the dataset level, the principal is granted `READER` access to the dataset. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Table - View - Routine This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.models.export` `bigquery.models.getData` `bigquery.models.getMetadata` `bigquery.models.list` `bigquery.propertyGraphs.get` `bigquery.propertyGraphs.list` `bigquery.routines.get` `bigquery.routines.list` `bigquery.tables.createSnapshot` `bigquery.tables.export` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.getIamPolicy` `bigquery.tables.list` `bigquery.tables.replicateData` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Job User (`roles/bigquery.jobUser`) Provides permissions to run jobs, including queries, within the project. This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.config.get` `bigquery.jobs.create` `dataform.folders.create` `dataform.locations.*` - `dataform.locations.get` - `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Metadata Viewer (`roles/bigquery.metadataViewer`) When granted on a dataset, this role grants these permissions: - Get metadata and access controls for the dataset. - Get metadata and access controls for tables and views. - Get metadata from the dataset's models and routines. - List tables, views, models, and routines in the dataset. When granted on a table or view, this role provides these permissions: - Get metadata and access controls for the table or view. When granted on a routine, this role grants these permissions: - In a query, reference a routine created by someone else. This role cannot be granted to individual models. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Table - View - Routine This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.models.getMetadata` `bigquery.models.list` `bigquery.propertyGraphs.get` `bigquery.propertyGraphs.list` `bigquery.routines.get` `bigquery.routines.list` `bigquery.tables.get` `bigquery.tables.getIamPolicy` `bigquery.tables.list` `dataplex.projects.search` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Read Session User (`roles/bigquery.readSessionUser`) Provides the ability to create and use read sessions. This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.readsessions.*` - `bigquery.readsessions.create` - `bigquery.readsessions.getData` - `bigquery.readsessions.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Resource Admin (`roles/bigquery.resourceAdmin`) Administers BigQuery workloads, including slot assignments, commitments, and reservations. This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.bireservations.*` - `bigquery.bireservations.get` - `bigquery.bireservations.update` `bigquery.capacityCommitments.*` - `bigquery.capacityCommitments.create` - `bigquery.capacityCommitments.delete` - `bigquery.capacityCommitments.get` - `bigquery.capacityCommitments.list` - `bigquery.capacityCommitments.update` `bigquery.jobs.get` `bigquery.jobs.list` `bigquery.jobs.listAll` `bigquery.jobs.listExecutionMetadata` `bigquery.reservationAssignments.*` - `bigquery.reservationAssignments.create` - `bigquery.reservationAssignments.delete` - `bigquery.reservationAssignments.list` - `bigquery.reservationAssignments.search` `bigquery.reservationGroups.*` - `bigquery.reservationGroups.create` - `bigquery.reservationGroups.delete` - `bigquery.reservationGroups.get` - `bigquery.reservationGroups.list` - `bigquery.reservationGroups.update` `bigquery.reservations.*` - `bigquery.reservations.create` - `bigquery.reservations.delete` - `bigquery.reservations.get` - `bigquery.reservations.getIamPolicy` - `bigquery.reservations.list` - `bigquery.reservations.listFailoverDatasets` - `bigquery.reservations.setIamPolicy` - `bigquery.reservations.update` - `bigquery.reservations.use` `recommender.bigqueryCapacityCommitmentsInsights.*` - `recommender.bigqueryCapacityCommitmentsInsights.get` - `recommender.bigqueryCapacityCommitmentsInsights.list` - `recommender.bigqueryCapacityCommitmentsInsights.update` `recommender.bigqueryCapacityCommitmentsRecommendations.*` - `recommender.bigqueryCapacityCommitmentsRecommendations.get` - `recommender.bigqueryCapacityCommitmentsRecommendations.list` - `recommender.bigqueryCapacityCommitmentsRecommendations.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Resource Editor (`roles/bigquery.resourceEditor`) Manages BigQuery workloads, but is unable to create or modify slot commitments. This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.bireservations.get` `bigquery.capacityCommitments.get` `bigquery.capacityCommitments.list` `bigquery.jobs.get` `bigquery.jobs.list` `bigquery.jobs.listAll` `bigquery.jobs.listExecutionMetadata` `bigquery.reservationAssignments.*` - `bigquery.reservationAssignments.create` - `bigquery.reservationAssignments.delete` - `bigquery.reservationAssignments.list` - `bigquery.reservationAssignments.search` `bigquery.reservationGroups.*` - `bigquery.reservationGroups.create` - `bigquery.reservationGroups.delete` - `bigquery.reservationGroups.get` - `bigquery.reservationGroups.list` - `bigquery.reservationGroups.update` `bigquery.reservations.create` `bigquery.reservations.delete` `bigquery.reservations.get` `bigquery.reservations.list` `bigquery.reservations.listFailoverDatasets` `bigquery.reservations.update` `bigquery.reservations.use` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Resource Viewer (`roles/bigquery.resourceViewer`) Can view BigQuery workloads, but cannot create or modify slot reservations or commitments. This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.bireservations.get` `bigquery.capacityCommitments.get` `bigquery.capacityCommitments.list` `bigquery.jobs.get` `bigquery.jobs.list` `bigquery.jobs.listAll` `bigquery.jobs.listExecutionMetadata` `bigquery.reservationAssignments.list` `bigquery.reservationAssignments.search` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list` `bigquery.reservations.get` `bigquery.reservations.list` `bigquery.reservations.listFailoverDatasets` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Studio Admin (`roles/bigquery.studioAdmin`) Combination role of BigQuery Admin, Dataform Admin, Notebook Runtime Admin and Dataproc Serverless Editor. It is possible to grant this role to the following lowest-level resources, but it is not recommended. Other predefined roles grant full permissions over these resources and are less permissive. BigQuery Studio Admin is typically granted at the project level. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Table - View - Routine - Connection - Saved query - Data canvas - Data preparation - Pipeline - Repository This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `aiplatform.locations.get` `aiplatform.notebookRuntimeTemplates.*` - `aiplatform.notebookRuntimeTemplates.apply` - `aiplatform.notebookRuntimeTemplates.create` - `aiplatform.notebookRuntimeTemplates.delete` - `aiplatform.notebookRuntimeTemplates.get` - `aiplatform.notebookRuntimeTemplates.getIamPolicy` - `aiplatform.notebookRuntimeTemplates.list` - `aiplatform.notebookRuntimeTemplates.setIamPolicy` - `aiplatform.notebookRuntimeTemplates.update` `aiplatform.notebookRuntimes.*` - `aiplatform.notebookRuntimes.assign` - `aiplatform.notebookRuntimes.delete` - `aiplatform.notebookRuntimes.get` - `aiplatform.notebookRuntimes.list` - `aiplatform.notebookRuntimes.start` - `aiplatform.notebookRuntimes.update` - `aiplatform.notebookRuntimes.upgrade` `aiplatform.operations.list` `bigquery.bireservations.*` - `bigquery.bireservations.get` - `bigquery.bireservations.update` `bigquery.capacityCommitments.*` - `bigquery.capacityCommitments.create` - `bigquery.capacityCommitments.delete` - `bigquery.capacityCommitments.get` - `bigquery.capacityCommitments.list` - `bigquery.capacityCommitments.update` `bigquery.config.*` - `bigquery.config.get` - `bigquery.config.update` `bigquery.connections.*` - `bigquery.connections.create` - `bigquery.connections.delegate` - `bigquery.connections.delete` - `bigquery.connections.get` - `bigquery.connections.getIamPolicy` - `bigquery.connections.list` - `bigquery.connections.setIamPolicy` - `bigquery.connections.update` - `bigquery.connections.updateTag` - `bigquery.connections.use` `bigquery.dataPolicies.attach` `bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update` `bigquery.datasets.*` - `bigquery.datasets.create` - `bigquery.datasets.createTagBinding` - `bigquery.datasets.delete` - `bigquery.datasets.deleteTagBinding` - `bigquery.datasets.get` - `bigquery.datasets.getIamPolicy` - `bigquery.datasets.link` - `bigquery.datasets.listEffectiveTags` - `bigquery.datasets.listSharedDatasetUsage` - `bigquery.datasets.listTagBindings` - `bigquery.datasets.setIamPolicy` - `bigquery.datasets.update` - `bigquery.datasets.updateTag` `bigquery.jobs.*` - `bigquery.jobs.create` - `bigquery.jobs.createGlobalQuery` - `bigquery.jobs.delete` - `bigquery.jobs.get` - `bigquery.jobs.list` - `bigquery.jobs.listAll` - `bigquery.jobs.listExecutionMetadata` - `bigquery.jobs.update` `bigquery.models.*` - `bigquery.models.create` - `bigquery.models.delete` - `bigquery.models.export` - `bigquery.models.getData` - `bigquery.models.getMetadata` - `bigquery.models.list` - `bigquery.models.updateData` - `bigquery.models.updateMetadata` - `bigquery.models.updateTag` `bigquery.objectRefs.*` - `bigquery.objectRefs.read` - `bigquery.objectRefs.write` `bigquery.propertyGraphs.*` - `bigquery.propertyGraphs.create` - `bigquery.propertyGraphs.delete` - `bigquery.propertyGraphs.get` - `bigquery.propertyGraphs.list` - `bigquery.propertyGraphs.update` `bigquery.readsessions.*` - `bigquery.readsessions.create` - `bigquery.readsessions.getData` - `bigquery.readsessions.update` `bigquery.reservationAssignments.*` - `bigquery.reservationAssignments.create` - `bigquery.reservationAssignments.delete` - `bigquery.reservationAssignments.list` - `bigquery.reservationAssignments.search` `bigquery.reservationGroups.*` - `bigquery.reservationGroups.create` - `bigquery.reservationGroups.delete` - `bigquery.reservationGroups.get` - `bigquery.reservationGroups.list` - `bigquery.reservationGroups.update` `bigquery.reservations.*` - `bigquery.reservations.create` - `bigquery.reservations.delete` - `bigquery.reservations.get` - `bigquery.reservations.getIamPolicy` - `bigquery.reservations.list` - `bigquery.reservations.listFailoverDatasets` - `bigquery.reservations.setIamPolicy` - `bigquery.reservations.update` - `bigquery.reservations.use` `bigquery.routines.*` - `bigquery.routines.create` - `bigquery.routines.delete` - `bigquery.routines.get` - `bigquery.routines.list` - `bigquery.routines.update` - `bigquery.routines.updateTag` `bigquery.rowAccessPolicies.create` `bigquery.rowAccessPolicies.delete` `bigquery.rowAccessPolicies.get` `bigquery.rowAccessPolicies.getIamPolicy` `bigquery.rowAccessPolicies.list` `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions` `bigquery.rowAccessPolicies.setIamPolicy` `bigquery.rowAccessPolicies.update` `bigquery.savedqueries.*` - `bigquery.savedqueries.create` - `bigquery.savedqueries.delete` - `bigquery.savedqueries.get` - `bigquery.savedqueries.list` - `bigquery.savedqueries.update` `bigquery.tables.*` - `bigquery.tables.create` - `bigquery.tables.createIndex` - `bigquery.tables.createSnapshot` - `bigquery.tables.createTagBinding` - `bigquery.tables.delete` - `bigquery.tables.deleteIndex` - `bigquery.tables.deleteSnapshot` - `bigquery.tables.deleteTagBinding` - `bigquery.tables.export` - `bigquery.tables.get` - `bigquery.tables.getData` - `bigquery.tables.getIamPolicy` - `bigquery.tables.list` - `bigquery.tables.listEffectiveTags` - `bigquery.tables.listTagBindings` - `bigquery.tables.replicateData` - `bigquery.tables.restoreSnapshot` - `bigquery.tables.setCategory` - `bigquery.tables.setColumnDataPolicy` - `bigquery.tables.setIamPolicy` - `bigquery.tables.update` - `bigquery.tables.updateData` - `bigquery.tables.updateIndex` - `bigquery.tables.updateTag` `bigquery.transfers.*` - `bigquery.transfers.get` - `bigquery.transfers.update` `bigquerymigration.translation.translate` `cloudaicompanion.aiDevToolsSettings.*` - `cloudaicompanion.aiDevToolsSettings.create` - `cloudaicompanion.aiDevToolsSettings.delete` - `cloudaicompanion.aiDevToolsSettings.get` - `cloudaicompanion.aiDevToolsSettings.list` - `cloudaicompanion.aiDevToolsSettings.update` `cloudaicompanion.codeToolsSettings.*` - `cloudaicompanion.codeToolsSettings.create` - `cloudaicompanion.codeToolsSettings.delete` - `cloudaicompanion.codeToolsSettings.get` - `cloudaicompanion.codeToolsSettings.list` - `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.companions.*` - `cloudaicompanion.companions.generateChat` - `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.*` - `cloudaicompanion.dataSharingWithGoogleSettings.create` - `cloudaicompanion.dataSharingWithGoogleSettings.delete` - `cloudaicompanion.dataSharingWithGoogleSettings.get` - `cloudaicompanion.dataSharingWithGoogleSettings.list` - `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.*` - `cloudaicompanion.geminiGcpEnablementSettings.create` - `cloudaicompanion.geminiGcpEnablementSettings.delete` - `cloudaicompanion.geminiGcpEnablementSettings.get` - `cloudaicompanion.geminiGcpEnablementSettings.list` - `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.*` - `cloudaicompanion.instances.completeCode` - `cloudaicompanion.instances.completeTask` - `cloudaicompanion.instances.exportMetrics` - `cloudaicompanion.instances.generateCode` - `cloudaicompanion.instances.generateText` - `cloudaicompanion.instances.queryEffectiveSetting` - `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.*` - `cloudaicompanion.loggingSettings.create` - `cloudaicompanion.loggingSettings.delete` - `cloudaicompanion.loggingSettings.get` - `cloudaicompanion.loggingSettings.list` - `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.get` `cloudaicompanion.releaseChannelSettings.*` - `cloudaicompanion.releaseChannelSettings.create` - `cloudaicompanion.releaseChannelSettings.delete` - `cloudaicompanion.releaseChannelSettings.get` - `cloudaicompanion.releaseChannelSettings.list` - `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.*` - `cloudaicompanion.settingBindings.aiDevToolsSettingsCreate` - `cloudaicompanion.settingBindings.aiDevToolsSettingsDelete` - `cloudaicompanion.settingBindings.aiDevToolsSettingsGet` - `cloudaicompanion.settingBindings.aiDevToolsSettingsList` - `cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate` - `cloudaicompanion.settingBindings.aiDevToolsSettingsUse` - `cloudaicompanion.settingBindings.codeToolsSettingsCreate` - `cloudaicompanion.settingBindings.codeToolsSettingsDelete` - `cloudaicompanion.settingBindings.codeToolsSettingsGet` - `cloudaicompanion.settingBindings.codeToolsSettingsList` - `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` - `cloudaicompanion.settingBindings.codeToolsSettingsUse` - `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` - `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` - `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` - `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` - `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` - `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` - `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` - `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` - `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` - `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` - `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` - `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` - `cloudaicompanion.settingBindings.loggingSettingsCreate` - `cloudaicompanion.settingBindings.loggingSettingsDelete` - `cloudaicompanion.settingBindings.loggingSettingsGet` - `cloudaicompanion.settingBindings.loggingSettingsList` - `cloudaicompanion.settingBindings.loggingSettingsUpdate` - `cloudaicompanion.settingBindings.loggingSettingsUse` - `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` - `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` - `cloudaicompanion.settingBindings.releaseChannelSettingsGet` - `cloudaicompanion.settingBindings.releaseChannelSettingsList` - `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` - `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `cloudaicompanion.topics.create` `cloudkms.keyHandles.*` - `cloudkms.keyHandles.create` - `cloudkms.keyHandles.get` - `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `compute.projects.get` `compute.regions.*` - `compute.regions.get` - `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.zones.*` - `compute.zones.get` - `compute.zones.list` `dataform.*` - `dataform.commentThreads.create` - `dataform.commentThreads.delete` - `dataform.commentThreads.get` - `dataform.commentThreads.list` - `dataform.commentThreads.update` - `dataform.comments.create` - `dataform.comments.delete` - `dataform.comments.get` - `dataform.comments.list` - `dataform.comments.update` - `dataform.compilationResults.create` - `dataform.compilationResults.get` - `dataform.compilationResults.list` - `dataform.compilationResults.query` - `dataform.config.get` - `dataform.config.update` - `dataform.folders.addContents` - `dataform.folders.create` - `dataform.folders.delete` - `dataform.folders.deleteTree` - `dataform.folders.get` - `dataform.folders.getIamPolicy` - `dataform.folders.move` - `dataform.folders.queryContents` - `dataform.folders.setIamPolicy` - `dataform.folders.update` - `dataform.locations.get` - `dataform.locations.list` - `dataform.operations.cancel` - `dataform.operations.delete` - `dataform.operations.get` - `dataform.operations.list` - `dataform.releaseConfigs.create` - `dataform.releaseConfigs.delete` - `dataform.releaseConfigs.get` - `dataform.releaseConfigs.list` - `dataform.releaseConfigs.update` - `dataform.repositories.commit` - `dataform.repositories.computeAccessTokenStatus` - `dataform.repositories.create` - `dataform.repositories.createTagBinding` - `dataform.repositories.delete` - `dataform.repositories.deleteTagBinding` - `dataform.repositories.fetchHistory` - `dataform.repositories.fetchRemoteBranches` - `dataform.repositories.get` - `dataform.repositories.getIamPolicy` - `dataform.repositories.list` - `dataform.repositories.listEffectiveTags` - `dataform.repositories.listTagBindings` - `dataform.repositories.move` - `dataform.repositories.queryDirectoryContents` - `dataform.repositories.readFile` - `dataform.repositories.scheduleRelease` - `dataform.repositories.scheduleWorkflow` - `dataform.repositories.setIamPolicy` - `dataform.repositories.update` - `dataform.teamFolders.create` - `dataform.teamFolders.delete` - `dataform.teamFolders.deleteTree` - `dataform.teamFolders.get` - `dataform.teamFolders.getIamPolicy` - `dataform.teamFolders.setIamPolicy` - `dataform.teamFolders.update` - `dataform.workflowConfigs.create` - `dataform.workflowConfigs.delete` - `dataform.workflowConfigs.get` - `dataform.workflowConfigs.list` - `dataform.workflowConfigs.update` - `dataform.workflowInvocations.cancel` - `dataform.workflowInvocations.create` - `dataform.workflowInvocations.delete` - `dataform.workflowInvocations.get` - `dataform.workflowInvocations.list` - `dataform.workflowInvocations.query` - `dataform.workspaces.commit` - `dataform.workspaces.create` - `dataform.workspaces.delete` - `dataform.workspaces.fetchFileDiff` - `dataform.workspaces.fetchFileGitStatuses` - `dataform.workspaces.fetchGitAheadBehind` - `dataform.workspaces.get` - `dataform.workspaces.getIamPolicy` - `dataform.workspaces.installNpmPackages` - `dataform.workspaces.list` - `dataform.workspaces.makeDirectory` - `dataform.workspaces.moveDirectory` - `dataform.workspaces.moveFile` - `dataform.workspaces.pull` - `dataform.workspaces.push` - `dataform.workspaces.queryDirectoryContents` - `dataform.workspaces.readFile` - `dataform.workspaces.removeDirectory` - `dataform.workspaces.removeFile` - `dataform.workspaces.reset` - `dataform.workspaces.searchFiles` - `dataform.workspaces.setIamPolicy` - `dataform.workspaces.writeFile` `dataplex.datascans.*` - `dataplex.datascans.cancel` - `dataplex.datascans.create` - `dataplex.datascans.delete` - `dataplex.datascans.get` - `dataplex.datascans.getData` - `dataplex.datascans.getIamPolicy` - `dataplex.datascans.list` - `dataplex.datascans.run` - `dataplex.datascans.setIamPolicy` - `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list` `dataplex.projects.search` `dataproc.batches.analyze` `dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list` `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.operations.cancel` `dataproc.operations.delete` `dataproc.operations.get` `dataproc.operations.list` `dataproc.sessionTemplates.*` - `dataproc.sessionTemplates.create` - `dataproc.sessionTemplates.delete` - `dataproc.sessionTemplates.get` - `dataproc.sessionTemplates.list` - `dataproc.sessionTemplates.update` `dataproc.sessions.*` - `dataproc.sessions.create` - `dataproc.sessions.delete` - `dataproc.sessions.get` - `dataproc.sessions.list` - `dataproc.sessions.sparkApplicationRead` - `dataproc.sessions.sparkApplicationWrite` - `dataproc.sessions.terminate` `dataprocrm.nodePools.*` - `dataprocrm.nodePools.create` - `dataprocrm.nodePools.delete` - `dataprocrm.nodePools.deleteNodes` - `dataprocrm.nodePools.get` - `dataprocrm.nodePools.list` - `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.update` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.*` - `dataprocrm.workloads.cancel` - `dataprocrm.workloads.create` - `dataprocrm.workloads.delete` - `dataprocrm.workloads.get` - `dataprocrm.workloads.list` `geminicloudassist.agents.invoke` `geminidataanalytics.*` - `geminidataanalytics.dataAgents.chat` - `geminidataanalytics.dataAgents.create` - `geminidataanalytics.dataAgents.delete` - `geminidataanalytics.dataAgents.get` - `geminidataanalytics.dataAgents.getIamPolicy` - `geminidataanalytics.dataAgents.list` - `geminidataanalytics.dataAgents.setIamPolicy` - `geminidataanalytics.dataAgents.update` - `geminidataanalytics.locations.chat` - `geminidataanalytics.locations.get` - `geminidataanalytics.locations.list` - `geminidataanalytics.locations.useDataEngineeringAgent` - `geminidataanalytics.operations.cancel` - `geminidataanalytics.operations.delete` - `geminidataanalytics.operations.get` - `geminidataanalytics.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Studio User (`roles/bigquery.studioUser`) Combination role of BigQuery Job User, BigQuery Read Session User, Dataform Code Creator, Notebook Runtime User and Dataproc Serverless Editor. Lowest-level resources where you can grant this role: - Saved query - Data canvas - Data preparation - Pipeline - Repository This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `aiplatform.locations.get` `aiplatform.notebookRuntimeTemplates.apply` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.getIamPolicy` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimes.assign` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.operations.list` `bigquery.config.get` `bigquery.jobs.create` `bigquery.readsessions.*` - `bigquery.readsessions.create` - `bigquery.readsessions.getData` - `bigquery.readsessions.update` `cloudaicompanion.companions.*` - `cloudaicompanion.companions.generateChat` - `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.*` - `cloudaicompanion.instances.completeCode` - `cloudaicompanion.instances.completeTask` - `cloudaicompanion.instances.exportMetrics` - `cloudaicompanion.instances.generateCode` - `cloudaicompanion.instances.generateText` - `cloudaicompanion.instances.queryEffectiveSetting` - `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create` `cloudkms.keyHandles.*` - `cloudkms.keyHandles.create` - `cloudkms.keyHandles.get` - `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `compute.projects.get` `compute.regions.*` - `compute.regions.get` - `compute.regions.list` `compute.zones.*` - `compute.zones.get` - `compute.zones.list` `dataform.commentThreads.get` `dataform.commentThreads.list` `dataform.comments.get` `dataform.comments.list` `dataform.folders.create` `dataform.locations.*` - `dataform.locations.get` - `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list` `dataplex.projects.search` `dataproc.batches.analyze` `dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list` `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.operations.cancel` `dataproc.operations.delete` `dataproc.operations.get` `dataproc.operations.list` `dataproc.sessionTemplates.*` - `dataproc.sessionTemplates.create` - `dataproc.sessionTemplates.delete` - `dataproc.sessionTemplates.get` - `dataproc.sessionTemplates.list` - `dataproc.sessionTemplates.update` `dataproc.sessions.*` - `dataproc.sessions.create` - `dataproc.sessions.delete` - `dataproc.sessions.get` - `dataproc.sessions.list` - `dataproc.sessions.sparkApplicationRead` - `dataproc.sessions.sparkApplicationWrite` - `dataproc.sessions.terminate` `dataprocrm.nodePools.*` - `dataprocrm.nodePools.create` - `dataprocrm.nodePools.delete` - `dataprocrm.nodePools.deleteNodes` - `dataprocrm.nodePools.get` - `dataprocrm.nodePools.list` - `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.update` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.*` - `dataprocrm.workloads.cancel` - `dataprocrm.workloads.create` - `dataprocrm.workloads.delete` - `dataprocrm.workloads.get` - `dataprocrm.workloads.list` `geminicloudassist.agents.invoke` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.locations.chat` `geminidataanalytics.locations.useDataEngineeringAgent` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery User (`roles/bigquery.user`) When granted on a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When granted on a project, this role also provides the ability to run jobs, including queries, within the project. A principal with this role can enumerate their own jobs, cancel their own jobs, and enumerate datasets within a project. Additionally, allows the creation of new datasets within the project; the creator is granted the BigQuery Data Owner role (`roles/bigquery.dataOwner`) on these new datasets. Lowest-level resources where you can grant this role: - Dataset - These resources within a dataset: - Routine This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.bireservations.get` `bigquery.capacityCommitments.get` `bigquery.capacityCommitments.list` `bigquery.config.get` `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.jobs.create` `bigquery.jobs.list` `bigquery.models.list` `bigquery.propertyGraphs.list` `bigquery.readsessions.*` - `bigquery.readsessions.create` - `bigquery.readsessions.getData` - `bigquery.readsessions.update` `bigquery.reservationAssignments.list` `bigquery.reservationAssignments.search` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list` `bigquery.reservations.get` `bigquery.reservations.list` `bigquery.reservations.listFailoverDatasets` `bigquery.reservations.use` `bigquery.routines.list` `bigquery.savedqueries.get` `bigquery.savedqueries.list` `bigquery.tables.list` `bigquery.transfers.get` `bigquerymigration.translation.translate` `cloudkms.keyHandles.*` - `cloudkms.keyHandles.create` - `cloudkms.keyHandles.get` - `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `dataform.folders.create` `dataform.locations.*` - `dataform.locations.get` - `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list` `dataplex.projects.search` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Filtered Data Viewer (`roles/bigquery.filteredDataViewer`) Access to view filtered table data defined by a row access policy. `bigquery.filteredDataViewer` is a system-managed role. Grant the role by using row-level access policies. Don't apply the role directly to a resource through Identity and Access Management (IAM). | `bigquery.rowAccessPolicies.getFilteredData` | | #### BigQuery ObjectRef Admin (`roles/bigquery.objectRefAdmin`) Administer ObjectRef resources that includes read and write permissions Lowest-level resources where you can grant this role: - Connection This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.objectRefs.*` - `bigquery.objectRefs.read` - `bigquery.objectRefs.write` | | #### BigQuery ObjectRef Reader (`roles/bigquery.objectRefReader`) Role for reading referenced objects via ObjectRefs in BigQuery Lowest-level resources where you can grant this role: - Connection This role can also be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.objectRefs.read` | | #### BigQuery Authorized Routine Admin ^Beta^ (`roles/bigquery.routineAdmin`) Role for Authorized Routine to administer supported resources | `bigquery.connections.use` `bigquery.datasets.get` `bigquery.models.getData` `bigquery.models.getMetadata` `bigquery.routines.get` `bigquery.routines.list` `bigquery.tables.create` `bigquery.tables.delete` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.list` `bigquery.tables.update` `bigquery.tables.updateData` | | #### BigQuery Authorized Routine Data Editor ^Beta^ (`roles/bigquery.routineDataEditor`) Role for Authorized Routine to edit contents of supported resources | `bigquery.datasets.get` `bigquery.models.getData` `bigquery.models.getMetadata` `bigquery.routines.get` `bigquery.routines.list` `bigquery.tables.create` `bigquery.tables.delete` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.list` `bigquery.tables.update` `bigquery.tables.updateData` | | #### BigQuery Authorized Routine Data Viewer ^Beta^ (`roles/bigquery.routineDataViewer`) Role for Authorized Routine to view data and contents of supported resources | `bigquery.datasets.get` `bigquery.models.getData` `bigquery.models.getMetadata` `bigquery.routines.get` `bigquery.routines.list` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.list` | | #### BigQuery Authorized Routine Metadata Viewer ^Beta^ (`roles/bigquery.routineMetadataViewer`) Role for Authorized Routine to view metadata of supported resources | `bigquery.datasets.get` `bigquery.models.getMetadata` `bigquery.routines.get` `bigquery.routines.list` `bigquery.tables.get` `bigquery.tables.list` | | #### BigQuery Security Admin ^Beta^ (`roles/bigquery.securityAdmin`) Administer all BigQuery security controls | `bigquery.dataPolicies.attach` `bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update` `bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.datasets.listEffectiveTags` `bigquery.datasets.listSharedDatasetUsage` `bigquery.datasets.listTagBindings` `bigquery.datasets.setIamPolicy` `bigquery.datasets.update` `bigquery.datasets.updateTag` `bigquery.rowAccessPolicies.create` `bigquery.rowAccessPolicies.delete` `bigquery.rowAccessPolicies.get` `bigquery.rowAccessPolicies.getIamPolicy` `bigquery.rowAccessPolicies.list` `bigquery.rowAccessPolicies.setIamPolicy` `bigquery.rowAccessPolicies.update` `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.get` `bigquery.tables.getIamPolicy` `bigquery.tables.list` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings` `bigquery.tables.setColumnDataPolicy` `bigquery.tables.setIamPolicy` `bigquery.tables.update` `bigquery.tables.updateTag` `dataplex.projects.search` | ### Service agent roles Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### Connected Sheets Service Agent (`roles/bigquery.connectedSheetsServiceAgent`) Grants Connected Sheets Service Account access to create and manage BigQuery jobs on the customers resources. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `bigquery.datasets.get` `bigquery.jobs.create` `bigquery.tables.create` `bigquery.tables.update` `bigquery.tables.updateData` | ### BigQuery Connection API roles This table lists the predefined IAM roles and permissions for BigQuery Connection API. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). BigQuery Connection API offers the following service agent roles. Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### BigQuery Connection Service Agent (`roles/bigqueryconnection.serviceAgent`) Gives BigQuery Connection Service access to Cloud SQL instances in user projects. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `cloudsql.instances.connect` `cloudsql.instances.get` `logging.logEntries.create` `logging.logEntries.route` `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.*` - `monitoring.monitoredResourceDescriptors.get` - `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create` | ### BigQuery Continuous Query roles This table lists the predefined IAM roles and permissions for BigQuery Continuous Query. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). BigQuery Continuous Query offers the following service agent roles. Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### BigQuery Continuous Query Service Agent (`roles/bigquerycontinuousquery.serviceAgent`) Gives BigQuery Continuous Query access to the service accounts in the user project. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `iam.serviceAccounts.getAccessToken` | ### BigQuery Data Policy roles This table lists the predefined IAM roles and permissions for BigQuery Data Policy. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Role | Permissions | |---|---| | #### BigQuery Data Policy Admin (`roles/bigquerydatapolicy.admin`) Role for managing Data Policies in BigQuery This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.dataPolicies.attach` `bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update` | | #### BigQuery Data Policy Editor (`roles/bigquerydatapolicy.editor`) Editor role for BigQuery Data Policy | `bigquery.bireservations.*` - `bigquery.bireservations.get` - `bigquery.bireservations.update` `bigquery.capacityCommitments.get` `bigquery.capacityCommitments.list` `bigquery.capacityCommitments.update` `bigquery.config.*` - `bigquery.config.get` - `bigquery.config.update` `bigquery.connections.create` `bigquery.connections.delete` `bigquery.connections.get` `bigquery.connections.getIamPolicy` `bigquery.connections.list` `bigquery.connections.update` `bigquery.connections.updateTag` `bigquery.connections.use` `bigquery.dataPolicies.attach` `bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.update` `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.datasets.listEffectiveTags` `bigquery.datasets.listTagBindings` `bigquery.datasets.updateTag` `bigquery.jobs.create` `bigquery.jobs.createGlobalQuery` `bigquery.jobs.delete` `bigquery.jobs.get` `bigquery.jobs.list` `bigquery.jobs.listExecutionMetadata` `bigquery.models.*` - `bigquery.models.create` - `bigquery.models.delete` - `bigquery.models.export` - `bigquery.models.getData` - `bigquery.models.getMetadata` - `bigquery.models.list` - `bigquery.models.updateData` - `bigquery.models.updateMetadata` - `bigquery.models.updateTag` `bigquery.objectRefs.*` - `bigquery.objectRefs.read` - `bigquery.objectRefs.write` `bigquery.propertyGraphs.*` - `bigquery.propertyGraphs.create` - `bigquery.propertyGraphs.delete` - `bigquery.propertyGraphs.get` - `bigquery.propertyGraphs.list` - `bigquery.propertyGraphs.update` `bigquery.readsessions.*` - `bigquery.readsessions.create` - `bigquery.readsessions.getData` - `bigquery.readsessions.update` `bigquery.reservationAssignments.*` - `bigquery.reservationAssignments.create` - `bigquery.reservationAssignments.delete` - `bigquery.reservationAssignments.list` - `bigquery.reservationAssignments.search` `bigquery.reservationGroups.*` - `bigquery.reservationGroups.create` - `bigquery.reservationGroups.delete` - `bigquery.reservationGroups.get` - `bigquery.reservationGroups.list` - `bigquery.reservationGroups.update` `bigquery.reservations.create` `bigquery.reservations.delete` `bigquery.reservations.get` `bigquery.reservations.getIamPolicy` `bigquery.reservations.list` `bigquery.reservations.listFailoverDatasets` `bigquery.reservations.update` `bigquery.reservations.use` `bigquery.routines.*` - `bigquery.routines.create` - `bigquery.routines.delete` - `bigquery.routines.get` - `bigquery.routines.list` - `bigquery.routines.update` - `bigquery.routines.updateTag` `bigquery.rowAccessPolicies.create` `bigquery.rowAccessPolicies.delete` `bigquery.rowAccessPolicies.get` `bigquery.rowAccessPolicies.getIamPolicy` `bigquery.rowAccessPolicies.list` `bigquery.rowAccessPolicies.update` `bigquery.savedqueries.*` - `bigquery.savedqueries.create` - `bigquery.savedqueries.delete` - `bigquery.savedqueries.get` - `bigquery.savedqueries.list` - `bigquery.savedqueries.update` `bigquery.tables.createIndex` `bigquery.tables.createSnapshot` `bigquery.tables.deleteIndex` `bigquery.tables.getIamPolicy` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings` `bigquery.tables.replicateData` `bigquery.tables.restoreSnapshot` `bigquery.tables.updateIndex` `bigquery.transfers.*` - `bigquery.transfers.get` - `bigquery.transfers.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### BigQuery Data Policy Viewer (`roles/bigquerydatapolicy.viewer`) Role for viewing Data Policies in BigQuery This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.dataPolicies.get` `bigquery.dataPolicies.list` | | #### Masked Reader (`roles/bigquerydatapolicy.maskedReader`) Masked read access to sub-resources tagged by the policy tag associated with a data policy, for example, BigQuery columns This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.dataPolicies.maskedGet` | | #### Raw Data Reader ^Beta^ (`roles/bigquerydatapolicy.rawDataReader`) Raw read access to sub-resources associated with a data policy, for example, BigQuery columns This role can only be granted on Resource Manager resources (projects, folders, and organizations). | `bigquery.dataPolicies.getRawData` | ### BigQuery Data Transfer Service roles This table lists the predefined IAM roles and permissions for BigQuery Data Transfer Service. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). BigQuery Data Transfer Service offers the following service agent roles. Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### BigQuery Data Transfer Service Agent (`roles/bigquerydatatransfer.serviceAgent`) Gives BigQuery Data Transfer Service access to start BigQuery jobs in consumer project. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `bigquery.config.get` `bigquery.connections.delegate` `bigquery.jobs.create` `compute.networkAttachments.get` `compute.networkAttachments.update` `compute.regionOperations.get` `compute.subnetworks.use` `dataform.folders.create` `dataform.locations.*` - `dataform.locations.get` - `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataProfileAspect` `dataplex.entryGroups.useDatabaseDataPolicyAspect` `dataplex.entryGroups.useMySQLConnectorTypes` `dataplex.entryGroups.useOracleConnectorTypes` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.usePostgreSQLConnectorTypes` `dataplex.entryGroups.useSQLAccessAspect` `dataplex.entryGroups.useSQLServerConnectorTypes` `dataplex.entryGroups.useSQLTriggersAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSecondaryIndexesAspect` `dataplex.entryGroups.useStorageAspect` `dataplex.metadataJobs.create` `dataplex.metadataJobs.get` `dataplex.metadataJobs.list` `iam.serviceAccounts.getAccessToken` `logging.logEntries.create` `logging.logEntries.route` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.services.use` | ### BigQuery Engine for Apache Flink roles This table lists the predefined IAM roles and permissions for BigQuery Engine for Apache Flink. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Role | Permissions | |---|---| | #### Managed Flink Admin ^Beta^ (`roles/managedflink.admin`) Full access to Managed Flink resources. | `managedflink.*` - `managedflink.deployments.create` - `managedflink.deployments.delete` - `managedflink.deployments.get` - `managedflink.deployments.list` - `managedflink.deployments.update` - `managedflink.jobs.create` - `managedflink.jobs.delete` - `managedflink.jobs.get` - `managedflink.jobs.list` - `managedflink.jobs.update` - `managedflink.locations.get` - `managedflink.locations.list` - `managedflink.operations.cancel` - `managedflink.operations.delete` - `managedflink.operations.get` - `managedflink.operations.list` - `managedflink.sessions.create` - `managedflink.sessions.delete` - `managedflink.sessions.get` - `managedflink.sessions.list` - `managedflink.sessions.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Managed Flink Viewer ^Beta^ (`roles/managedflink.viewer`) Readonly access to Managed Flink resources. | `managedflink.deployments.get` `managedflink.deployments.list` `managedflink.jobs.get` `managedflink.jobs.list` `managedflink.locations.*` - `managedflink.locations.get` - `managedflink.locations.list` `managedflink.operations.get` `managedflink.operations.list` `managedflink.sessions.get` `managedflink.sessions.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Managed Flink Developer ^Beta^ (`roles/managedflink.developer`) Full access to Managed Flink Jobs and Sessions and read access to Deployments. | `managedflink.deployments.get` `managedflink.deployments.list` `managedflink.jobs.*` - `managedflink.jobs.create` - `managedflink.jobs.delete` - `managedflink.jobs.get` - `managedflink.jobs.list` - `managedflink.jobs.update` `managedflink.locations.*` - `managedflink.locations.get` - `managedflink.locations.list` `managedflink.operations.get` `managedflink.operations.list` `managedflink.sessions.*` - `managedflink.sessions.create` - `managedflink.sessions.delete` - `managedflink.sessions.get` - `managedflink.sessions.list` - `managedflink.sessions.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | ### Service agent roles Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### Managed Flink Service Agent (`roles/managedflink.serviceAgent`) Gives Managed Flink Service Agent access to Cloud Platform resources. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkAttachments.update` `compute.networks.get` `compute.networks.list` `compute.regionOperations.get` `compute.subnetworks.get` `compute.subnetworks.list` `compute.subnetworks.use` `dns.networks.targetWithPeeringZone` `managedkafka.clusters.get` `managedkafka.clusters.list` `managedkafka.clusters.update` `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.*` - `monitoring.monitoredResourceDescriptors.get` - `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create` `serviceusage.services.use` `storage.objects.get` | ### BigQuery Migration Service roles This table lists the predefined IAM roles and permissions for BigQuery Migration Service. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Role | Permissions | |---|---| | #### Bigquerymigration Admin (`roles/bigquerymigration.admin`) Admin role for bigquerymigration | `bigquerymigration.*` - `bigquerymigration.subtasks.get` - `bigquerymigration.subtasks.list` - `bigquerymigration.translation.translate` - `bigquerymigration.workflows.create` - `bigquerymigration.workflows.delete` - `bigquerymigration.workflows.enableAiOutputTypes` - `bigquerymigration.workflows.enableLineageOutputTypes` - `bigquerymigration.workflows.enableOutputTypePermissions` - `bigquerymigration.workflows.get` - `bigquerymigration.workflows.list` - `bigquerymigration.workflows.orchestrateTask` - `bigquerymigration.workflows.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### MigrationWorkflow Editor (`roles/bigquerymigration.editor`) Editor of EDW migration workflows. | `bigquerymigration.subtasks.*` - `bigquerymigration.subtasks.get` - `bigquerymigration.subtasks.list` `bigquerymigration.workflows.create` `bigquerymigration.workflows.delete` `bigquerymigration.workflows.enableAiOutputTypes` `bigquerymigration.workflows.enableLineageOutputTypes` `bigquerymigration.workflows.enableOutputTypePermissions` `bigquerymigration.workflows.get` `bigquerymigration.workflows.list` `bigquerymigration.workflows.update` | | #### MigrationWorkflow Viewer (`roles/bigquerymigration.viewer`) Viewer of EDW migration MigrationWorkflow. | `bigquerymigration.subtasks.*` - `bigquerymigration.subtasks.get` - `bigquerymigration.subtasks.list` `bigquerymigration.workflows.get` `bigquerymigration.workflows.list` | | #### Migration Management Editor ^Beta^ (`roles/bigquerymigration.migrationEditor`) Admin of EDW migrations. | | | #### Migration Management Viewer ^Beta^ (`roles/bigquerymigration.migrationViewer`) Viewer of EDW migrations. | | | #### Task Orchestrator (`roles/bigquerymigration.orchestrator`) Orchestrator of EDW migration tasks. | `bigquerymigration.workflows.orchestrateTask` `storage.objects.list` | | #### Migration Translation User (`roles/bigquerymigration.translationUser`) User of EDW migration interactive SQL translation service. | `bigquerymigration.translation.translate` | | #### Task Worker (`roles/bigquerymigration.worker`) Worker that executes EDW migration subtasks. | `storage.objects.create` `storage.objects.get` `storage.objects.list` | ### Service agent roles Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### BigQuery Migration Service Agent (`roles/bigquerymigration.serviceAgent`) Access required for the BigQuery Migration Service to perform data discovery, metadata registration, and manage data transfers. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `resourcemanager.projects.get` | ### BigQuery Omni roles This table lists the predefined IAM roles and permissions for BigQuery Omni. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). BigQuery Omni offers the following service agent roles. Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### BigQuery Omni Service Agent (`roles/bigqueryomni.serviceAgent`) Gives BigQuery Omni access to tables in user projects. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `bigquery.jobs.create` `bigquery.tables.updateData` | ### BigQuery sharing roles This table lists the predefined IAM roles and permissions for BigQuery sharing. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Role | Permissions | |---|---| | #### Analytics Hub Admin (`roles/analyticshub.admin`) Administer Data Exchanges and Listings | `analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.update` `analyticshub.listings.viewSubscriptions` `analyticshub.queryTemplates.*` - `analyticshub.queryTemplates.approve` - `analyticshub.queryTemplates.create` - `analyticshub.queryTemplates.delete` - `analyticshub.queryTemplates.get` - `analyticshub.queryTemplates.list` - `analyticshub.queryTemplates.update` `analyticshub.subscriptions.*` - `analyticshub.subscriptions.create` - `analyticshub.subscriptions.delete` - `analyticshub.subscriptions.get` - `analyticshub.subscriptions.list` - `analyticshub.subscriptions.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Analytics Hub Editor (`roles/analyticshub.editor`) Editor role for Analytics Hub | `analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.update` `analyticshub.queryTemplates.*` - `analyticshub.queryTemplates.approve` - `analyticshub.queryTemplates.create` - `analyticshub.queryTemplates.delete` - `analyticshub.queryTemplates.get` - `analyticshub.queryTemplates.list` - `analyticshub.queryTemplates.update` `analyticshub.subscriptions.*` - `analyticshub.subscriptions.create` - `analyticshub.subscriptions.delete` - `analyticshub.subscriptions.get` - `analyticshub.subscriptions.list` - `analyticshub.subscriptions.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Analytics Hub Viewer (`roles/analyticshub.viewer`) Can browse Data Exchanges and Listings | `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.queryTemplates.get` `analyticshub.queryTemplates.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Analytics Hub Listing Admin (`roles/analyticshub.listingAdmin`) Grants full control over the Listing, including updating, deleting and setting ACLs | `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.update` `analyticshub.listings.viewSubscriptions` `analyticshub.queryTemplates.get` `analyticshub.queryTemplates.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Analytics Hub Publisher (`roles/analyticshub.publisher`) Can publish to Data Exchanges thus creating Listings | `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.listings.create` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.queryTemplates.*` - `analyticshub.queryTemplates.approve` - `analyticshub.queryTemplates.create` - `analyticshub.queryTemplates.delete` - `analyticshub.queryTemplates.get` - `analyticshub.queryTemplates.list` - `analyticshub.queryTemplates.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Analytics Hub Subscriber (`roles/analyticshub.subscriber`) Can browse Data Exchanges and subscribe to Listings | `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.subscribe` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.subscribe` `analyticshub.queryTemplates.get` `analyticshub.queryTemplates.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | | #### Analytics Hub Subscription Owner (`roles/analyticshub.subscriptionOwner`) Grants full control over the Subscription, including updating and deleting | `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.queryTemplates.get` `analyticshub.queryTemplates.list` `analyticshub.subscriptions.*` - `analyticshub.subscriptions.create` - `analyticshub.subscriptions.delete` - `analyticshub.subscriptions.get` - `analyticshub.subscriptions.list` - `analyticshub.subscriptions.update` `resourcemanager.projects.get` `resourcemanager.projects.list` | ### Service agent roles Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | Role | Permissions | |---|---| | #### Analytics Hub Service Agent (`roles/analyticshub.serviceAgent`) Grants Analytics Hub Service Agent permissions required to manage resources in the consumer project. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). | `analyticshub.dataExchanges.list` `resourcemanager.projects.get` `resourcemanager.projects.list` | ## BigQuery permissions The following tables list the permissions available in BigQuery. These are included in predefined roles and can be used in custom role definitions. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). ### BigQuery permissions This table lists the IAM permissions for BigQuery and the roles that include them. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Permission | Included in roles | |---|---| | #### `bigquery.bireservations.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.bireservations.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.capacityCommitments.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.capacityCommitments.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.capacityCommitments.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.capacityCommitments.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.capacityCommitments.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.config.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Job User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.jobUser) (`roles/bigquery.jobUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Studio User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioUser) (`roles/bigquery.studioUser`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [BigQuery Data Transfer Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatatransfer#bigquerydatatransfer.serviceAgent) (`roles/bigquerydatatransfer.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [FleetEngine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/fleetengine#fleetengine.serviceAgent) (`roles/fleetengine.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) | | #### `bigquery.config.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Assured Workloads Administrator](https://docs.cloud.google.com/iam/docs/roles-permissions/assuredworkloads#assuredworkloads.admin) (`roles/assuredworkloads.admin`) [Assured Workloads Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/assuredworkloads#assuredworkloads.editor) (`roles/assuredworkloads.editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.delegate` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [BigQuery Data Transfer Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatatransfer#bigquerydatatransfer.serviceAgent) (`roles/bigquerydatatransfer.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Dataplex Discovery BigLake Publishing Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.discoveryBigLakePublishingServiceAgent) (`roles/dataplex.discoveryBigLakePublishingServiceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) | | #### `bigquery.connections.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Connection User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionUser) (`roles/bigquery.connectionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.editor) (`roles/datacatalog.editor`) [Data Catalog Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.viewer) (`roles/datacatalog.viewer`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) | | #### `bigquery.connections.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Connection User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionUser) (`roles/bigquery.connectionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Connection User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionUser) (`roles/bigquery.connectionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.updateTag` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Tag Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.tagEditor) (`roles/datacatalog.tagEditor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.connections.use` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Connection Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionAdmin) (`roles/bigquery.connectionAdmin`) [BigQuery Connection User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectionUser) (`roles/bigquery.connectionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Dataplex Discovery BigLake Publishing Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.discoveryBigLakePublishingServiceAgent) (`roles/dataplex.discoveryBigLakePublishingServiceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.dataPolicies.attach` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Data Policy Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.viewer) (`roles/bigquerydatapolicy.viewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.getRawData` | [Raw Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.rawDataReader) (`roles/bigquerydatapolicy.rawDataReader`) | | #### `bigquery.dataPolicies.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Data Policy Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.viewer) (`roles/bigquerydatapolicy.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.maskedGet` | [Masked Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.maskedReader) (`roles/bigquerydatapolicy.maskedReader`) | | #### `bigquery.dataPolicies.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.dataPolicies.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.admin) (`roles/bigquerydatapolicy.admin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.datasets.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Commerce Business Enablement Configuration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/commercebusinessenablement#commercebusinessenablement.admin) (`roles/commercebusinessenablement.admin`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Kubernetes Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/container#container.serviceAgent) (`roles/container.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Dataplex Discovery Publishing Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.discoveryPublishingServiceAgent) (`roles/dataplex.discoveryPublishingServiceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Dialogflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) (`roles/dialogflow.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [FleetEngine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/fleetengine#fleetengine.serviceAgent) (`roles/fleetengine.serviceAgent`) - [Cloud Logging Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/logging#logging.serviceAgent) (`roles/logging.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Observability Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/observability#observability.serviceAgent) (`roles/observability.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Spectrum SAS Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/spectrumsas#spectrumsas.serviceAgent) (`roles/spectrumsas.serviceAgent`) - [StorageInsights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/storageinsights#storageinsights.serviceAgent) (`roles/storageinsights.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.datasets.createTagBinding` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.datasets.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.datasets.deleteTagBinding` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.datasets.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Commerce Business Enablement Configuration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/commercebusinessenablement#commercebusinessenablement.admin) (`roles/commercebusinessenablement.admin`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.editor) (`roles/datacatalog.editor`) [Data Catalog Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.viewer) (`roles/datacatalog.viewer`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [BigQuery Authorized Routine Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineMetadataViewer) (`roles/bigquery.routineMetadataViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [SLZ BQDW Blueprint Project Level Remediator](https://docs.cloud.google.com/iam/docs/roles-permissions/securedlandingzone#securedlandingzone.bqdwProjectRemediator) (`roles/securedlandingzone.bqdwProjectRemediator`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [Audit Manager Auditing Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/auditmanager#auditmanager.serviceAgent) (`roles/auditmanager.serviceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Connected Sheets Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectedSheetsServiceAgent) (`roles/bigquery.connectedSheetsServiceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Security Compliance Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudsecuritycompliance#cloudsecuritycompliance.serviceAgent) (`roles/cloudsecuritycompliance.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Kubernetes Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/container#container.serviceAgent) (`roles/container.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Dataplex Discovery Publishing Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.discoveryPublishingServiceAgent) (`roles/dataplex.discoveryPublishingServiceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [FleetEngine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/fleetengine#fleetengine.serviceAgent) (`roles/fleetengine.serviceAgent`) - [Cloud Logging Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/logging#logging.serviceAgent) (`roles/logging.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Observability Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/observability#observability.serviceAgent) (`roles/observability.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Security Center Control Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/securitycenter#securitycenter.controlServiceAgent) (`roles/securitycenter.controlServiceAgent`) - [Security Health Analytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/securitycenter#securitycenter.securityHealthAnalyticsServiceAgent) (`roles/securitycenter.securityHealthAnalyticsServiceAgent`) - [Security Center Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/securitycenter#securitycenter.serviceAgent) (`roles/securitycenter.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.datasets.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [SLZ BQDW Blueprint Project Level Remediator](https://docs.cloud.google.com/iam/docs/roles-permissions/securedlandingzone#securedlandingzone.bqdwProjectRemediator) (`roles/securedlandingzone.bqdwProjectRemediator`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) | | #### `bigquery.datasets.link` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Cloud Logging Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/logging#logging.serviceAgent) (`roles/logging.serviceAgent`) - [Observability Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/observability#observability.serviceAgent) (`roles/observability.serviceAgent`) | | #### `bigquery.datasets.listEffectiveTags` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [Tag Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagViewer) (`roles/resourcemanager.tagViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.datasets.listSharedDatasetUsage` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.datasets.listTagBindings` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [Tag Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagViewer) (`roles/resourcemanager.tagViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.datasets.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [SLZ BQDW Blueprint Project Level Remediator](https://docs.cloud.google.com/iam/docs/roles-permissions/securedlandingzone#securedlandingzone.bqdwProjectRemediator) (`roles/securedlandingzone.bqdwProjectRemediator`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) | | #### `bigquery.datasets.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Commerce Business Enablement Configuration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/commercebusinessenablement#commercebusinessenablement.admin) (`roles/commercebusinessenablement.admin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [SLZ BQDW Blueprint Project Level Remediator](https://docs.cloud.google.com/iam/docs/roles-permissions/securedlandingzone#securedlandingzone.bqdwProjectRemediator) (`roles/securedlandingzone.bqdwProjectRemediator`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) | | #### `bigquery.datasets.updateTag` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Data Catalog Tag Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.tagEditor) (`roles/datacatalog.tagEditor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.jobs.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Job User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.jobUser) (`roles/bigquery.jobUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Studio User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioUser) (`roles/bigquery.studioUser`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Connected Sheets Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectedSheetsServiceAgent) (`roles/bigquery.connectedSheetsServiceAgent`) - [BigQuery Data Transfer Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatatransfer#bigquerydatatransfer.serviceAgent) (`roles/bigquerydatatransfer.serviceAgent`) - [BigQuery Omni Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigqueryomni#bigqueryomni.serviceAgent) (`roles/bigqueryomni.serviceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.serviceAgent) (`roles/datastudio.serviceAgent`) - [Dialogflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) (`roles/dialogflow.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [FleetEngine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/fleetengine#fleetengine.serviceAgent) (`roles/fleetengine.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/monitoring#monitoring.notificationServiceAgent) (`roles/monitoring.notificationServiceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Spectrum SAS Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/spectrumsas#spectrumsas.serviceAgent) (`roles/spectrumsas.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.jobs.createGlobalQuery` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.jobs.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) | | #### `bigquery.jobs.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.jobs.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) | | #### `bigquery.jobs.listAll` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.jobs.listExecutionMetadata` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.jobs.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) | | #### `bigquery.models.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.models.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.models.export` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.models.getData` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) | | #### `bigquery.models.getMetadata` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.editor) (`roles/datacatalog.editor`) [Data Catalog Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.viewer) (`roles/datacatalog.viewer`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [BigQuery Authorized Routine Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineMetadataViewer) (`roles/bigquery.routineMetadataViewer`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) | | #### `bigquery.models.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) | | #### `bigquery.models.updateData` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.models.updateMetadata` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.models.updateTag` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Tag Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.tagEditor) (`roles/datacatalog.tagEditor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.objectRefs.read` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery ObjectRef Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.objectRefAdmin) (`roles/bigquery.objectRefAdmin`) [BigQuery ObjectRef Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.objectRefReader) (`roles/bigquery.objectRefReader`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.objectRefs.write` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery ObjectRef Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.objectRefAdmin) (`roles/bigquery.objectRefAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.propertyGraphs.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.propertyGraphs.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.propertyGraphs.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.propertyGraphs.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.propertyGraphs.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.readsessions.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Read Session User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.readSessionUser) (`roles/bigquery.readSessionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Studio User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioUser) (`roles/bigquery.studioUser`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.readsessions.getData` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Read Session User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.readSessionUser) (`roles/bigquery.readSessionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Studio User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioUser) (`roles/bigquery.studioUser`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) | | #### `bigquery.readsessions.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Read Session User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.readSessionUser) (`roles/bigquery.readSessionUser`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Studio User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioUser) (`roles/bigquery.studioUser`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.reservationAssignments.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservationAssignments.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservationAssignments.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservationAssignments.search` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservationGroups.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservationGroups.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservationGroups.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservationGroups.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservationGroups.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservations.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservations.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservations.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservations.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservations.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservations.listFailoverDatasets` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Resource Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceViewer) (`roles/bigquery.resourceViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.reservations.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservations.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.reservations.use` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Resource Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceAdmin) (`roles/bigquery.resourceAdmin`) [BigQuery Resource Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.resourceEditor) (`roles/bigquery.resourceEditor`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.routines.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.routines.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.routines.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.editor) (`roles/datacatalog.editor`) [Data Catalog Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.viewer) (`roles/datacatalog.viewer`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [BigQuery Authorized Routine Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineMetadataViewer) (`roles/bigquery.routineMetadataViewer`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.routines.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [BigQuery Authorized Routine Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineMetadataViewer) (`roles/bigquery.routineMetadataViewer`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.routines.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.routines.updateTag` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Tag Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.tagEditor) (`roles/datacatalog.tagEditor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.getFilteredData` | [BigQuery Filtered Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.filteredDataViewer) (`roles/bigquery.filteredDataViewer`) | | #### `bigquery.rowAccessPolicies.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.rowAccessPolicies.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.rowAccessPolicies.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.savedqueries.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.savedqueries.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.savedqueries.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.savedqueries.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquery.savedqueries.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) | | #### `bigquery.tables.create` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Connected Sheets Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectedSheetsServiceAgent) (`roles/bigquery.connectedSheetsServiceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Kubernetes Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/container#container.serviceAgent) (`roles/container.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [Dialogflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) (`roles/dialogflow.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Spectrum SAS Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/spectrumsas#spectrumsas.serviceAgent) (`roles/spectrumsas.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.tables.createIndex` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.createSnapshot` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) | | #### `bigquery.tables.createTagBinding` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.tables.delete` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.deleteIndex` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.deleteSnapshot` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.deleteTagBinding` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.tables.export` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.tables.get` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [Data Catalog Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.editor) (`roles/datacatalog.editor`) [Data Catalog Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.viewer) (`roles/datacatalog.viewer`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [BigQuery Authorized Routine Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineMetadataViewer) (`roles/bigquery.routineMetadataViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Kubernetes Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/container#container.serviceAgent) (`roles/container.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Datapipelines Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datapipelines#datapipelines.serviceAgent) (`roles/datapipelines.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Dialogflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) (`roles/dialogflow.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.tables.getData` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Data Labeling Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datalabeling#datalabeling.serviceAgent) (`roles/datalabeling.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [Dialogflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) (`roles/dialogflow.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [FleetEngine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/fleetengine#fleetengine.serviceAgent) (`roles/fleetengine.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.tables.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.list` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.metadataViewer) (`roles/bigquery.metadataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Authorized Routine Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataViewer) (`roles/bigquery.routineDataViewer`) [BigQuery Authorized Routine Metadata Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineMetadataViewer) (`roles/bigquery.routineMetadataViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataReader) (`roles/dataplex.storageDataReader`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Looker Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/looker#looker.serviceAgent) (`roles/looker.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) | | #### `bigquery.tables.listEffectiveTags` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [Tag Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagViewer) (`roles/resourcemanager.tagViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.tables.listTagBindings` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) [Tag Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagViewer) (`roles/resourcemanager.tagViewer`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [DSPM Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dspm#dspm.serviceAgent) (`roles/dspm.serviceAgent`) | | #### `bigquery.tables.replicateData` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) [Site Reliability Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.siteReliabilityEngineer) (`roles/iam.siteReliabilityEngineer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.restoreSnapshot` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.setCategory` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.setColumnDataPolicy` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.update` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Connected Sheets Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectedSheetsServiceAgent) (`roles/bigquery.connectedSheetsServiceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Kubernetes Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/container#container.serviceAgent) (`roles/container.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.tables.updateData` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Authorized Routine Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineAdmin) (`roles/bigquery.routineAdmin`) [BigQuery Authorized Routine Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.routineDataEditor) (`roles/bigquery.routineDataEditor`) [Dataplex Storage Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataOwner) (`roles/dataplex.storageDataOwner`) [Dataplex Storage Data Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.storageDataWriter) (`roles/dataplex.storageDataWriter`) [Datastream Bigquery Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.bigqueryWriter) (`roles/datastream.bigqueryWriter`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Vertex AI Batch Prediction Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.batchPredictionServiceAgent) (`roles/aiplatform.batchPredictionServiceAgent`) - [Vertex AI Custom Code Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.customCodeServiceAgent) (`roles/aiplatform.customCodeServiceAgent`) - [Vertex AI Model Monitoring Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.modelMonitoringServiceAgent) (`roles/aiplatform.modelMonitoringServiceAgent`) - [Vertex AI RAG Data Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.ragServiceAgent) (`roles/aiplatform.ragServiceAgent`) - [Vertex AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.serviceAgent) (`roles/aiplatform.serviceAgent`) - [Vertex AI Tuning Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.tuningServiceAgent) (`roles/aiplatform.tuningServiceAgent`) - [AutoML Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automl#automl.serviceAgent) (`roles/automl.serviceAgent`) - [Recommendations AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/automlrecommendations#automlrecommendations.serviceAgent) (`roles/automlrecommendations.serviceAgent`) - [Connected Sheets Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.connectedSheetsServiceAgent) (`roles/bigquery.connectedSheetsServiceAgent`) - [BigQuery Omni Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/bigqueryomni#bigqueryomni.serviceAgent) (`roles/bigqueryomni.serviceAgent`) - [Customer Engagement Suite Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ces#ces.serviceAgent) (`roles/ces.serviceAgent`) - [Chronicle Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.serviceAgent) (`roles/chronicle.serviceAgent`) - [Cloud Asset Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudasset#cloudasset.serviceAgent) (`roles/cloudasset.serviceAgent`) - [Cloud Deployment Manager Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager#clouddeploymentmanager.serviceAgent) (`roles/clouddeploymentmanager.serviceAgent`) - [Contact Center AI Insights Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent) (`roles/contactcenterinsights.serviceAgent`) - [Kubernetes Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/container#container.serviceAgent) (`roles/container.serviceAgent`) - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Datastream Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastream#datastream.serviceAgent) (`roles/datastream.serviceAgent`) - [Data Studio Managed Storage Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datastudio#datastudio.managedStorageServiceAgent) (`roles/datastudio.managedStorageServiceAgent`) - [Dialogflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) (`roles/dialogflow.serviceAgent`) - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) - [Enterprise Knowledge Graph Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/enterpriseknowledgegraph#enterpriseknowledgegraph.serviceAgent) (`roles/enterpriseknowledgegraph.serviceAgent`) - [Firebase Crashlytics Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebasecrash#firebasecrashlytics.serviceAgent) (`roles/firebasecrashlytics.serviceAgent`) - [AI Platform Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/ml#ml.serviceAgent) (`roles/ml.serviceAgent`) - [Retail Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/retail#retail.serviceAgent) (`roles/retail.serviceAgent`) - [Spectrum SAS Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/spectrumsas#spectrumsas.serviceAgent) (`roles/spectrumsas.serviceAgent`) - [Cloud Vision AI Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/visionai#visionai.serviceAgent) (`roles/visionai.serviceAgent`) | | #### `bigquery.tables.updateIndex` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.tables.updateTag` | [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Data Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataEditor) (`roles/bigquery.dataEditor`) [BigQuery Data Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataOwner) (`roles/bigquery.dataOwner`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [Data Catalog Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.admin) (`roles/datacatalog.admin`) [BigQuery Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.securityAdmin) (`roles/bigquery.securityAdmin`) [Data Catalog Tag Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/datacatalog#datacatalog.tagEditor) (`roles/datacatalog.tagEditor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Data Scientist](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.dataScientist) (`roles/iam.dataScientist`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [ML Engineer](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.mlEngineer) (`roles/iam.mlEngineer`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Data Fusion API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/datafusion#datafusion.serviceAgent) (`roles/datafusion.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [DLP API Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.serviceAgent) (`roles/dlp.serviceAgent`) | | #### `bigquery.transfers.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) | | #### `bigquery.transfers.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery Data Policy Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerydatapolicy#bigquerydatapolicy.editor) (`roles/bigquerydatapolicy.editor`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Firebase Service Management Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/firebase#firebase.managementServiceAgent) (`roles/firebase.managementServiceAgent`) | ### BigQuery Connection API permissions There are no IAM permissions for this service. ### BigQuery Continuous Query permissions There are no IAM permissions for this service. ### BigQuery Data Policy permissions There are no IAM permissions for this service. ### BigQuery Data Transfer Service permissions There are no IAM permissions for this service. ### BigQuery Engine for Apache Flink permissions This table lists the IAM permissions for BigQuery Engine for Apache Flink and the roles that include them. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Permission | Included in roles | |---|---| | #### `managedflink.deployments.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) | | #### `managedflink.deployments.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) | | #### `managedflink.deployments.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.deployments.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.deployments.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) | | #### `managedflink.jobs.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.jobs.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.jobs.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.jobs.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.jobs.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.locations.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.locations.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.operations.cancel` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) | | #### `managedflink.operations.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) | | #### `managedflink.operations.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.operations.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.sessions.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.sessions.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.sessions.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.sessions.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.viewer) (`roles/managedflink.viewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | | #### `managedflink.sessions.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Managed Flink Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.admin) (`roles/managedflink.admin`) [Managed Flink Developer](https://docs.cloud.google.com/iam/docs/roles-permissions/managedflink#managedflink.developer) (`roles/managedflink.developer`) | ### BigQuery Migration Service permissions This table lists the IAM permissions for BigQuery Migration Service and the roles that include them. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Permission | Included in roles | |---|---| | #### `bigquerymigration.subtasks.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) [MigrationWorkflow Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.viewer) (`roles/bigquerymigration.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `bigquerymigration.subtasks.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) [MigrationWorkflow Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.viewer) (`roles/bigquerymigration.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `bigquerymigration.translation.translate` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [BigQuery Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.admin) (`roles/bigquery.admin`) [BigQuery Studio Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.studioAdmin) (`roles/bigquery.studioAdmin`) [BigQuery User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.user) (`roles/bigquery.user`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [Migration Translation User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.translationUser) (`roles/bigquerymigration.translationUser`) [DLP Organization Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.orgdriver) (`roles/dlp.orgdriver`) [DLP Project Data Profiles Driver](https://docs.cloud.google.com/iam/docs/roles-permissions/dlp#dlp.projectdriver) (`roles/dlp.projectdriver`) [Databases Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.databasesAdmin) (`roles/iam.databasesAdmin`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Cloud Dataflow Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataflow#dataflow.serviceAgent) (`roles/dataflow.serviceAgent`) - [Cloud Dataplex Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataplex#dataplex.serviceAgent) (`roles/dataplex.serviceAgent`) - [Dataprep Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/dataprep#dataprep.serviceAgent) (`roles/dataprep.serviceAgent`) | | #### `bigquerymigration.workflows.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) | | #### `bigquerymigration.workflows.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) | | #### `bigquerymigration.workflows.enableAiOutputTypes` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) | | #### `bigquerymigration.workflows.enableLineageOutputTypes` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) | | #### `bigquerymigration.workflows.enableOutputTypePermissions` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) | | #### `bigquerymigration.workflows.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) [MigrationWorkflow Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.viewer) (`roles/bigquerymigration.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `bigquerymigration.workflows.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) [MigrationWorkflow Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.viewer) (`roles/bigquerymigration.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `bigquerymigration.workflows.orchestrateTask` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [Task Orchestrator](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.orchestrator) (`roles/bigquerymigration.orchestrator`) | | #### `bigquerymigration.workflows.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Bigquerymigration Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.admin) (`roles/bigquerymigration.admin`) [MigrationWorkflow Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquerymigration#bigquerymigration.editor) (`roles/bigquerymigration.editor`) | ### BigQuery Omni permissions There are no IAM permissions for this service. ### BigQuery sharing permissions This table lists the IAM permissions for BigQuery sharing and the roles that include them. To search through all roles and permissions, see the [role and permission index](https://docs.cloud.google.com/iam/docs/roles-permissions). | Permission | Included in roles | |---|---| | #### `analyticshub.dataExchanges.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) | | #### `analyticshub.dataExchanges.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) | | #### `analyticshub.dataExchanges.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.dataExchanges.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.dataExchanges.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents). - [Analytics Hub Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.serviceAgent) (`roles/analyticshub.serviceAgent`) | | #### `analyticshub.dataExchanges.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) | | #### `analyticshub.dataExchanges.subscribe` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) | | #### `analyticshub.dataExchanges.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) | | #### `analyticshub.dataExchanges.viewSubscriptions` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) | | #### `analyticshub.listings.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) | | #### `analyticshub.listings.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) | | #### `analyticshub.listings.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.listings.getIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.listings.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.listings.setIamPolicy` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) | | #### `analyticshub.listings.subscribe` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) | | #### `analyticshub.listings.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) | | #### `analyticshub.listings.viewSubscriptions` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) | | #### `analyticshub.queryTemplates.approve` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) | | #### `analyticshub.queryTemplates.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) | | #### `analyticshub.queryTemplates.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) | | #### `analyticshub.queryTemplates.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.queryTemplates.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.viewer) (`roles/analyticshub.viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Analytics Hub Listing Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.listingAdmin) (`roles/analyticshub.listingAdmin`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) [Analytics Hub Subscriber](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriber) (`roles/analyticshub.subscriber`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.queryTemplates.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Publisher](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.publisher) (`roles/analyticshub.publisher`) | | #### `analyticshub.subscriptions.create` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) | | #### `analyticshub.subscriptions.delete` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) | | #### `analyticshub.subscriptions.get` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.subscriptions.list` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Viewer](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/viewer`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.securityReviewer) (`roles/iam.securityReviewer`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions#iam.supportUser) (`roles/iam.supportUser`) | | #### `analyticshub.subscriptions.update` | [Owner](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/owner`) [Editor](https://docs.cloud.google.com/iam/docs/roles-overview#basic) (`roles/editor`) [Analytics Hub Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.admin) (`roles/analyticshub.admin`) [Analytics Hub Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.editor) (`roles/analyticshub.editor`) [Analytics Hub Subscription Owner](https://docs.cloud.google.com/iam/docs/roles-permissions/analyticshub#analyticshub.subscriptionOwner) (`roles/analyticshub.subscriptionOwner`) | ## Permissions for BigQuery ML tasks The following table describes the permissions needed for common BigQuery ML tasks. | Permission | Description | |---|---| | `bigquery.jobs.create` `bigquery.models.create` `bigquery.models.getData` `bigquery.models.updateData` | Create a new model using `CREATE MODEL` statement | | `bigquery.jobs.create` `bigquery.models.create` `bigquery.models.getData` `bigquery.models.updateData` `bigquery.models.updateMetadata` | Replace an existing model using `CREATE OR REPLACE MODEL` statement | | `bigquery.models.delete` | Delete model using [models.delete](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/models/delete) API | | `bigquery.jobs.create` `bigquery.models.delete` | Delete model using `DROP MODEL` statement | | `bigquery.models.getMetadata` | Get model metadata using [models.get](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/models/get) API | | `bigquery.models.list` | List models and metadata on models using [models.list](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/models/list) API | | `bigquery.models.updateMetadata` | Update model metadata using [models.delete](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/models/delete) API. If setting or updating a non-zero expiration time for Model, `bigquery.models.delete` permission is also needed | | `bigquery.jobs.create` `bigquery.models.getData` | Perform evaluation, prediction and model and feature inspections using functions such as `ML.EVALUATE`, `ML.PREDICT`, `ML.TRAINING_INFO`, and `ML.WEIGHTS`. | | `bigquery.jobs.create` `bigquery.models.export` | Export a model | | `bigquery.models.updateTag` | Update [Data Catalog tags](https://docs.cloud.google.com/data-catalog/docs/tags-and-tag-templates) for a model. | ## What's next - For more information about assigning roles at the dataset level, see [Controlling access to datasets](https://docs.cloud.google.com/bigquery/docs/dataset-access-controls). - For more information about assigning roles at the table or view level, see [Controlling access to tables and views](https://docs.cloud.google.com/bigquery/docs/table-access-controls).