Why primitive roles get flagged specifically

roles/owner, roles/editor, and roles/viewer predate GCP's modern, fine-grained IAM system — they're broad, project-wide roles that grant sweeping access across every resource type in the project rather than scoping to the specific resources and actions a principal actually needs. Google's own IAM documentation recommends against using them in favor of predefined or custom roles scoped to what's genuinely required, precisely because "editor on this whole project" is very rarely the actual access someone needs — it's usually a shortcut taken during initial setup that never gets revisited. Flagging every primitive-role binding surfaces exactly the bindings worth reconsidering first in an access review.

allUsers vs. allAuthenticatedUsers — both mean "not actually restricted"

These two special member values are easy to mistake for something narrower than they are: allUsers grants access to literally anyone on the internet, with no authentication required at all, while allAuthenticatedUsers grants access to any Google account anywhere, not just accounts within your organization — it does not mean "anyone authenticated within my domain." Both are legitimate for genuinely public resources like a public website bucket, but attached to anything sensitive, either one is a much larger exposure than someone skimming a long bindings list might register at a glance, which is exactly why this tool calls both out explicitly rather than treating them like any other member string.