docs(google-cloud-platform): fix org-level role grant and add gcloud commands

[leet-c1]

Problem

The service account setup step read:

Under Grant this service account access to a project, assign the service account a role at the organization level.

That's self-contradictory. The service-account-creation wizard can only grant project-level roles — there's no way to reach the organization from it. Users follow the instruction, pick Editor, and get Editor on the project, which confers nothing at the organization node.

The connector's first call is Organizations.Get, so the sync fails immediately:

c1z-sync: failed getting metadata: google-cloud-platform: Organizations.Get('organizations/...')
failed: googleapi: Error 403: Permission 'resourcemanager.organizations.get' denied

with "reason": "IAM_PERMISSION_DENIED". This has hit at least one customer.

Note that resourcemanager.organizations.get was already correctly listed in the required-permissions block — the permission list was never wrong. Only the instruction about where to grant it was.

This PR also brings the page up to the standard set by the Google Cloud project setup guide for the MCP servers, which pairs every console procedure with its gcloud equivalent.

Commit 1: Fix the org-level role grant

• Service account creation now says to continue without selecting a role, with a warning explaining that project-level roles don't cover what the connector needs.
• New Grant organization-level access section performed after the account exists: select the organization in the resource picker, create the custom role under IAM & Admin > Roles, then grant it under IAM & Admin > IAM.
• Calls out that this requires Organization Administrator (roles/resourcemanager.organizationAdmin); project Owner is not sufficient.
• New troubleshooting section for the IAM_PERMISSION_DENIED error, including the case where the configured organization ID is simply wrong — Google returns an identical error for a nonexistent organization, so gcloud organizations list is suggested to rule that out.

The permission lists themselves are unchanged.

Commit 2: Add gcloud commands throughout

Every Google Cloud setup section now has both console steps and gcloud:

Section	Added
Create a new project	projects create, config set, organizations list
Enable the APIs	service ID table, services enable, services list --enabled
Optional: Sync secrets and buckets	service ID table, services enable, cloudasset.viewer org binding
Create a service account	service-accounts create
Grant organization-level access	roles create, add-iam-policy-binding, get-iam-policy verification
Get credentials	keys create, describe --format='value(uniqueId)', keys list

Also documents the service account key creation prerequisites, which the page never mentioned: the iam.serviceAccountKeys.create permission via the Service Account Key Admin role, and the constraints/iam.disableServiceAccountKeyCreation organization policy that Google enforces by default for organizations created on or after May 3, 2024. This connector requires a JSON key, so affected customers hit a hard stop with FAILED_PRECONDITION at that step.

Domain-wide delegation, the customer ID, and the primary domain live in Google Workspace and have no gcloud equivalent. Rather than leaving a silent gap, the page now says so explicitly.

Notes for review

• The Editor suggestion is removed rather than relocated. Editor at the organization would work but grants far more than the connector needs, and the custom role built from the documented permission list is already right there.
• API service IDs were verified against official Google documentation. storage.googleapis.com is the one that matches the console's "Cloud Storage API", as distinct from the similarly named storage-api.googleapis.com and storage-component.googleapis.com.
• Placeholders use YOUR_PROJECT_ID, YOUR_ORG_ID, and YOUR_SERVICE_ACCOUNT_EMAIL, matching the convention in the MCP setup guide. The example error uses a zeroed organization ID; no customer data appears anywhere in the diff.
• Verified: MDX component tags balanced, code fences even, all internal anchors resolve, and every Google Cloud setup section has either gcloud coverage or an explicit note that none exists.
• Not run: a Mintlify build, so rendering is unverified beyond the structural checks.

Out of scope

Separately, a customer looking for a Google Workspace directory connector can land on this page because of the "with Google Workspace" name adjacency. That's a catalog naming question rather than a docs fix, and no disambiguating guidance exists in the docs today. Not addressed here.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
conductorone	🟢 Ready	View Preview	Aug 14, 2026, 6:02 PM

[mindymo]

Pushed a few style fixes, good to go on the docs end. Reminder that we'll need to push this upstream to the baton- repo.