Cloud IAM provides the right tools to manage resource permissions with minimum fuss and high automation. You do not directly grant users permissions. Instead, you grant them roles, which bundle one or more permissions. This allows you to map job functions within your company to groups and roles.