Although this is an alpha feature at the time of this book being written, it is expected to be stabilized soon. You can create custom roles with custom permissions as per your requirements using IAM roles:

1. Navigate to the Roles tab in the IAM & admin panel:

2. Click on the Create Role button to add the role you desire.
3. Name the role and enter a convenient Role ID.

4. Enter the desired permissions. While doing so, you will be prompted to enter the status of the permission so that you can avoid adding permissions that are not supported:

5. You can also choose the availability of the role; since the feature is in alpha stage, you can chose to activate it immediately or after it becomes GA.
6. Confirm your action by clicking create, and the role will be created and will be available to be assigned to any member of the organization:

7. Similarly, a permission can be removed from a role using the Manage Permissions option.
8. We granted the Role to an individual Gmail user account, but the procedure remains the same for service account, group, or any other unit of identity supported by GCP.