{
  "title": "DDetectiveStateReadOnly",
  "description": "Least-privilege custom role for Cloudkeel-DD's GCP GCS raw .tfstate ingestion - read-only access to objects in one bucket. Separate, narrower role from DDetectiveReadOnly (docs/gcp-iam-roles.json), which is project-scoped for live-resource cross-checking.",
  "stage": "GA",
  "includedPermissions": [
    "storage.objects.get",
    "storage.objects.list"
  ]
}