What does an IAM allow policy in Google Cloud attach to, and what does it contain?

Why this is the answer

In Google Cloud the policy lives on the resource — organization, folder, project or an individual resource — and consists of bindings, each pairing one role with the members who hold it. Attaching a policy document to the principal instead is the AWS identity-policy model and is the usual carry-over error. Roles carry permissions, not resource lists. And API enablement belongs to Service Usage rather than IAM.