Identity family — first release

Added

Document	What it carries
`reference/identity/iam-model.md`	principals, permissions, roles, allow and deny policies, inheritance, eventual consistency, the fixed limits
`reference/identity/predefined-roles-and-permissions.md`	the two naming formats, basic-role warning, service accounts as identity and as resource, the three impersonation roles
`reference/identity/workload-identity-federation.md`	pools and providers, the principal strings, direct resource access against impersonation, the GKE form
`reference/identity/secret-manager-and-kms.md`	the secret/version model, replication policies, the accessor role, the KMS hierarchy and its four irreversible decisions
`reference/identity/errors.md`	the refusals, the Policy Troubleshooter command, the five-way evaluation, limits that present as errors
`guides/identity/fix-permission-denied.md`	seven steps in the order that answers fastest, and three things never to do
`guides/identity/github-actions-without-keys.md`	the documented keyless setup, with the attribute condition that makes it safe
`guides/parity/identity.md`	AWS and Azure counterparts, and the five differences that change an estimate

One contradiction found between two vendor pages

iam/docs/understanding-roles describes custom roles as organization-scoped; iam/quotas counts them per project and per organization (300 each). Recorded in reference/identity/predefined-roles-and-permissions.md §3 with the hub's reading, rather than silently resolved. Both pages read 2026-10-21.

Three absences recorded rather than filled in from memory

The Secret Manager overview gives no resource-name format, does not define latest, and does not

enumerate the version states.

The GKE Workload Identity Federation page does not say whether the feature is on by default on

Autopilot clusters.

The IAM troubleshooting page prints no verbatim denial string, so the error catalogue quotes Cloud

Storage's and Cloud Run's instead and says so.

Known missing

Organization policy constraints as a family of their own (named in reference/overview/, not documented).
IAM Conditions expression syntax (CEL) in detail.
Certificate-based federation (the AWS IAM Roles Anywhere analogue).
Privileged Access Manager, named only as a quota row.