---
cuppy_hub: gcp
cuppy_path: changelog/2026-10-21-identity-family.md
cuppy_section: docs
cuppy_doc: XT3T-D2QA
cuppy_doc_uuid: 04f2f5fd-d2ad-49b6-b566-907259fd756f
cuppy_permalink: https://cuppy.io/gcp/d/XT3T-D2QA
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/gcp/docs/changelog/2026-10-21-identity-family
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 7b4ae68c889c3a7c260dab48eddc3a80a9a24b378196821dc489cc16c13d91c8
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Identity family — first release

## Added

| Document | What it carries |
|---|---|
| `reference/identity/iam-model.md` | principals, permissions, roles, allow and deny policies, inheritance, eventual consistency, the fixed limits |
| `reference/identity/predefined-roles-and-permissions.md` | the two naming formats, basic-role warning, service accounts as identity and as resource, the three impersonation roles |
| `reference/identity/workload-identity-federation.md` | pools and providers, the principal strings, direct resource access against impersonation, the GKE form |
| `reference/identity/secret-manager-and-kms.md` | the secret/version model, replication policies, the accessor role, the KMS hierarchy and its four irreversible decisions |
| `reference/identity/errors.md` | the refusals, the Policy Troubleshooter command, the five-way evaluation, limits that present as errors |
| `guides/identity/fix-permission-denied.md` | seven steps in the order that answers fastest, and three things never to do |
| `guides/identity/github-actions-without-keys.md` | the documented keyless setup, with the attribute condition that makes it safe |
| `guides/parity/identity.md` | AWS and Azure counterparts, and the five differences that change an estimate |

## One contradiction found between two vendor pages

`iam/docs/understanding-roles` describes custom roles as organization-scoped; `iam/quotas` counts them **per
project and per organization** (300 each). Recorded in
`reference/identity/predefined-roles-and-permissions.md` §3 with the hub's reading, rather than silently
resolved. Both pages read 2026-10-21.

## Three absences recorded rather than filled in from memory

1. The Secret Manager overview gives **no resource-name format**, does not define `latest`, and does not
   enumerate the version states.
2. The GKE Workload Identity Federation page **does not say** whether the feature is on by default on
   Autopilot clusters.
3. The IAM troubleshooting page **prints no verbatim denial string**, so the error catalogue quotes Cloud
   Storage's and Cloud Run's instead and says so.

## Known missing

- Organization policy constraints as a family of their own (named in `reference/overview/`, not documented).
- IAM Conditions expression syntax (CEL) in detail.
- Certificate-based federation (the AWS IAM Roles Anywhere analogue).
- Privileged Access Manager, named only as a quota row.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 91 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/gcp/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->