Most IAM designs are built for a world where nothing goes wrong.
That world doesn’t exist.
In 2026, the real question is no longer:
“Does this identity have the right permissions?”
It’s:
“What happens when this identity gets compromised?”
Because when that happens — and eventually it will —
your carefully designed roles stop being your protection.
They become the attacker’s toolkit.
This is the blind spot in most Google Cloud IAM setups:
they focus on who can access what,
but ignore how far that access can spread after takeover.
That’s exactly the problem Principal Access Boundaries (PAB) are designed to solve.
Not by granting permissions.
Not by replacing least privilege.
But by doing something far more important:
Containing the blast radius of a compromised identity.
In this article, I’ll break down why traditional IAM is incomplete without containment, how PAB actually works under the hood, and why many teams get it dangerously wrong — especially when multiple policies start widening access instead of restricting it.
