Symptom: "Access Denied: Project [P]: The user/service account does not have bigquery.jobs.create permission in project [P]."

Cause: the identity cannot create query jobs billed to project [P]. This is the "who pays" permission, independent of "who can read the data".

Confirm:
1. Identify [P] in the error. Is that the project you meant to bill? Check your client's project setting.
2. `gcloud projects get-iam-policy [P]` - look for your identity with bigquery.jobUser or a role containing jobs.create.
3. Run `SELECT 1` as that identity: if it fails the same way, it is purely the jobs.create grant, not your SQL.

Fix: grant roles/bigquery.jobUser on [P] to the identity:
```
gcloud projects add-iam-policy-binding [P]   --member serviceAccount:[SA]   --role roles/bigquery.jobUser
```

Traps:
- Granting it on the DATA project when the error names the BILLING project. Read which project the error names.
- After fixing this, the next error is often the data half (tables.getData denied). That is expected: fix jobs.create first, then grant dataViewer on the data project.
- Service accounts in other projects querying your data need jobUser on THEIR billing project, which you may not control. Tell them which grant they need instead of guessing.

Verify: `SELECT 1` succeeds as the failing identity, then the real query runs.