Control objective
A clear and concise description of what the control objective is and why it's important.

Any GCP > Service account and Group having the below roles assigned should be unapproved

"roles/editor" 
"roles/owner" 
"roles/viewer" 
"roles/resourcemanager.tagUser" 
"roles/resourcemanager.tagAdmin" 
"roles/iam.serviceAccountTokenCreator"
"roles/iam.serviceAccountUser" 

Note:

1. These roles can be changed base on custom need.
2. This can be extended to GCP > IAM > Group (This resource type is under development)

Remediation
The remediation action(s) to satisfy the control objective.
Calc policy for GCP > IAM > Service Account > Approved > Custom

Categories
Proposed primary category and categories from the available list of categories.

Additional context
Add any other context about the problem here.