We use both. Have a managed project where people can create their own IAM roles using defined policies for all services. For some use cases creating your own ro

We use both. Have a managed project where people can create their own IAM roles using defined policies for all services. For some use cases creating your own role is better so they must attach one of the roles they create with the project as their boundary when they create the role.