In AWS we divide things up into child accounts that roughly match our org tree. Each team or service gets dev, staging, and prod child accounts. Teams have acce

In AWS we divide things up into child accounts that roughly match our org tree. Each team or service gets dev, staging, and prod child accounts. Teams have access to their child accounts and its fairly obvious what they all do, or at least, who to talk to to find out. I think my main complaint with GCP is that it is often tied directly to an org's gsuite account. And doing things in gsuite (used to?) automatically create GCP projects behind the scenes. So you could easily get thousands of projects that the users themselves didn't even know that they had created. If I were starting from scratch with GCP I'd use a third party IdP and not let users access it via their gsuite accounts. I suspect that would avoid most of the issues I've run into.