Symptom: "Access Denied: Project [P]: The user/service account does not have bigquery.jobs.create permission in project [P]."
Cause: the identity cannot create query jobs billed to project [P]. This is the "who pays" permission, independent of "who can read the data".
Confirm:
1. Identify [P] in the error. Is that the project you meant to bill? Check your client's project setting.
2. `gcloud projects get-iam-policy [P]` - look for your identity with bigquery.jobUser or a role containing jobs.create.
3. Run `SELECT 1` as that identity: if it fails the same way, it is purely the jobs.create grant, not your SQL.
Fix: grant roles/bigquery.jobUser on [P] to the identity:
```
gcloud projects add-iam-policy-binding [P] --member serviceAccount:[SA] --role roles/bigquery.jobUser
```
Traps:
- Granting it on the DATA project when the error names the BILLING project. Read which project the error names.
- After fixing this, the next error is often the data half (tables.getData denied). That is expected: fix jobs.create first, then grant dataViewer on the data project.
- Service accounts in other projects querying your data need jobUser on THEIR billing project, which you may not control. Tell them which grant they need instead of guessing.
Verify: `SELECT 1` succeeds as the failing identity, then the real query runs.