The Owner is required, because of the IAM permissions to create a service account, which will be used to run Datafold. After setting up Datafold, the permission can be revoked. The service account will run under “Project/Editor”, “Service Networking/Service Networking Admin” permissions. We'll enable the following GCP APIs to run Datafold: