BigQuery Role Grant Scope Hierarchy

Role scope in BigQuery controls whether access is broad or limited to one dataset or table. Granting a BigQuery role on an organization, folder, or project through Resource Manager gives permissions on all BigQuery resources in that organization or project. Assigning a role at the dataset level gives access to only that specific dataset without giving access to other datasets in the project, because datasets are child resources of projects.

Granting roles on individual resources within a dataset gives the narrowest access for table-level work. Roles can be applied directly to tables and views and to routines, which supports patterns such as allowing a user to read from one table but not write to it. To verify exactly which permissions a role contains before granting it, view the role in the console, run gcloud iam roles describe, call roles.get() for predefined roles, or check the BigQuery IAM roles and permissions reference and the IAM permissions reference.