Each user has a Pub/Sub topic and subscription; ensure only the user can publish and subscribe to their own resources. How should you enforce this?

Binding the user identity to roles/pubsub.publisher and roles/pubsub.subscriber directly on each specific topic and subscription resource ensures fine-grained access control. This means a user can only interact with their designated Pub/Sub resources, fulfilling the requirement that "only the user can publish and subscribe to their own resources." Granting roles at the project level would allow the user to publish/subscribe to any topic/subscription in the project, violating the isolation requirement. Custom roles with create permissions allow resource creation but don't control publish/subscribe access to existing resources. Running as a service account is for application-level access, not for individual user enforcement.