Permission	admin	viewer	cryptoOperator	ekmConnectionsAdmin	serviceAgent	hsmSingleTenantProposer	importer	cryptoKeyEncrypterDecrypterViaDelegation	hsmSingleTenantExecutor	hsmSingleTenantQuorumMember	signerVerifier	autokeyUser	cryptoKeyDecrypterViaDelegation	cryptoKeyEncrypterDecrypter	cryptoKeyEncrypterViaDelegation	decapsulator	expertPqcSigner	expertRawAesCbc	expertRawAesCtr	expertRawPKCS1	verifier	cryptoKeyDecrypter	cryptoKeyEncrypter	publicKeyViewer	signer	autokeyAdmin	hsmSingleTenantKeyCreator	keyAccessJustificationsPolicyConfigAdmin	orgServiceAgent	keyAccessJustificationsEnrollmentConfigViewer	protectedResourcesViewer
cloudasset.assets.listCloudkmsCryptoKeys					✔
cloudasset.assets.listResource					✔																								✔
cloudasset.assets.searchAllIamPolicies					✔																								✔
cloudasset.assets.searchAllResources					✔																								✔
cloudkms.autokeyConfigs.get	✔	✔																								✔
cloudkms.autokeyConfigs.update	✔																									✔
cloudkms.cryptoKeyVersions.create	✔
cloudkms.cryptoKeyVersions.delete	✔
cloudkms.cryptoKeyVersions.destroy	✔
cloudkms.cryptoKeyVersions.get	✔	✔
cloudkms.cryptoKeyVersions.list	✔	✔
cloudkms.cryptoKeyVersions.managePqcSign																	✔
cloudkms.cryptoKeyVersions.manageRawAesCbcKeys																		✔
cloudkms.cryptoKeyVersions.manageRawAesCtrKeys																			✔
cloudkms.cryptoKeyVersions.manageRawPKCS1Keys																				✔
cloudkms.cryptoKeyVersions.restore	✔
cloudkms.cryptoKeyVersions.update	✔
cloudkms.cryptoKeyVersions.useToDecapsulate			✔													✔
cloudkms.cryptoKeyVersions.useToDecrypt			✔											✔								✔
cloudkms.cryptoKeyVersions.useToDecryptViaDelegation	✔							✔					✔
cloudkms.cryptoKeyVersions.useToEncrypt			✔											✔									✔
cloudkms.cryptoKeyVersions.useToEncryptViaDelegation	✔							✔							✔
cloudkms.cryptoKeyVersions.useToSign			✔								✔														✔
cloudkms.cryptoKeyVersions.useToVerify			✔								✔										✔
cloudkms.cryptoKeyVersions.viewPublicKey			✔								✔					✔					✔			✔
cloudkms.cryptoKeys.create	✔				✔
cloudkms.cryptoKeys.delete	✔
cloudkms.cryptoKeys.get	✔	✔
cloudkms.cryptoKeys.getIamPolicy	✔				✔
cloudkms.cryptoKeys.list	✔	✔
cloudkms.cryptoKeys.setIamPolicy	✔				✔
cloudkms.cryptoKeys.update	✔
cloudkms.ekmConfigs.get	✔	✔		✔
cloudkms.ekmConfigs.getIamPolicy	✔
cloudkms.ekmConfigs.setIamPolicy	✔
cloudkms.ekmConfigs.update	✔			✔
cloudkms.ekmConnections.create	✔			✔
cloudkms.ekmConnections.get	✔	✔		✔
cloudkms.ekmConnections.getIamPolicy	✔
cloudkms.ekmConnections.list	✔	✔		✔
cloudkms.ekmConnections.setIamPolicy	✔
cloudkms.ekmConnections.update	✔			✔
cloudkms.ekmConnections.use	✔
cloudkms.ekmConnections.verifyConnectivity	✔			✔
cloudkms.importJobs.create	✔						✔
cloudkms.importJobs.get	✔	✔					✔
cloudkms.importJobs.getIamPolicy	✔
cloudkms.importJobs.list	✔	✔					✔
cloudkms.importJobs.setIamPolicy	✔
cloudkms.importJobs.useToImport	✔						✔
cloudkms.kajPolicyConfigs.get	✔	✔																										✔
cloudkms.kajPolicyConfigs.update	✔																											✔
cloudkms.keyHandles.create	✔											✔
cloudkms.keyHandles.get	✔	✔										✔
cloudkms.keyHandles.list	✔	✔										✔
cloudkms.keyRings.create	✔				✔
cloudkms.keyRings.createTagBinding	✔
cloudkms.keyRings.deleteTagBinding	✔
cloudkms.keyRings.get	✔	✔			✔
cloudkms.keyRings.getIamPolicy	✔
cloudkms.keyRings.list	✔	✔
cloudkms.keyRings.listEffectiveTags	✔
cloudkms.keyRings.listTagBindings	✔
cloudkms.keyRings.setIamPolicy	✔
cloudkms.locations.generateRandomBytes			✔
cloudkms.locations.get	✔	✔	✔				✔	✔			✔		✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔
cloudkms.locations.list	✔	✔	✔				✔	✔			✔		✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔
cloudkms.locations.optOutKeyDeletionMsa	✔
cloudkms.operations.get	✔	✔				✔			✔	✔		✔
cloudkms.projects.showEffectiveAutokeyConfig	✔											✔														✔
cloudkms.projects.showEffectiveKajEnrollmentConfig	✔																													✔
cloudkms.projects.showEffectiveKajPolicyConfig	✔																											✔
cloudkms.protectedResources.search																															✔
cloudkms.retiredResources.get	✔	✔
cloudkms.retiredResources.list	✔	✔
cloudkms.singleTenantHsmInstanceProposals.approve										✔
cloudkms.singleTenantHsmInstanceProposals.create						✔
cloudkms.singleTenantHsmInstanceProposals.delete	✔					✔
cloudkms.singleTenantHsmInstanceProposals.execute									✔
cloudkms.singleTenantHsmInstanceProposals.get	✔	✔				✔			✔	✔
cloudkms.singleTenantHsmInstanceProposals.list	✔	✔				✔			✔	✔
cloudkms.singleTenantHsmInstances.create	✔					✔
cloudkms.singleTenantHsmInstances.get	✔	✔				✔			✔	✔																	✔
cloudkms.singleTenantHsmInstances.list	✔	✔				✔			✔	✔																	✔
cloudkms.singleTenantHsmInstances.use	✔																										✔
resourcemanager.projects.get	✔	✔	✔	✔			✔	✔			✔		✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔
resourcemanager.projects.list				✔				✔					✔		✔		✔	✔	✔	✔