A partner running their application in their own GCP project needs access to a BigQuery dataset in your project. How should you provide access?

The correct approach is to have the partner create a service account in their own project and then grant that service account access to your BigQuery dataset. This maintains a clear separation of concerns and follows the principle of least privilege. You control access to your data, and the partner manages their own service accounts. Creating a service account in your project and granting it BigQuery access in your project would work, but it means you are managing a service account for an external entity, which is less ideal for security and management. Asking the partner to grant BigQuery access in their project to a service account from your project is incorrect because the BigQuery dataset resides in your project, not theirs. Asking the partner to create a service account in their project and grant it BigQuery access in their project is also incorrect because the access needs to be granted to your BigQuery dataset.