IssueTracker

What you would like to accomplish:

As of now, there is no feature to restrict any user that has an “Owner” or “Editor” role in a project to use Cloud Domains. This situation should be restricted to keep control over resources through the organization.

How this might work: An Org Policy could be created to restrict this ability to certain users or groups.

If applicable, reasons why alternative solutions are not sufficient: As of now, we haven’t found any alternatives to give granular roles to users, and only grant roles/domains.admin to users who should be able to register new Domains via Cloud Domains API.

Other information (workarounds you have tried, documentation consulted, etc): The document 1 describe access control over Cloud Domains, however, the roles that allow users to access this functionality are inherited in “Owner” and “Editor”