The principal in the request matches the principal in the policy. The
principal can be included directly or indirectly:
A principal is included directly if that principal is listed in the
role binding.
A principal is included indirectly if that principal is in a Google
group, Google Workspace account, or Cloud Identity domain that is listed
in the policy.
MembershipNotMatched
The principal in the request doesn't match the principal in the policy.
MembershipUnknownInfo
The principal in the policy is a group or domain, and the sender of the
request doesn't have permission to view whether the principal in the
request is a member of the group or domain.
