Diagnose: does not have bigquery.jobs.create permission in project

Symptom: "Access Denied: Project [P]: The user/service account does not have bigquery.jobs.create permission in project [P]."

Cause: the identity cannot create query jobs billed to project [P]. This is the "who pays" permission, independent of "who can read the data".

Confirm:

1. Identify [P] in the error. Is that the project you meant to bill? Check your client's project setting.
2. gcloud projects get-iam-policy [P] - look for your identity with bigquery.jobUser or a role containing jobs.create.
3. Run SELECT 1 as that identity: if it fails the same way, it is purely the jobs.create grant, not your SQL.

Fix: grant roles/bigquery.jobUser on [P] to the identity:

gcloud projects add-iam-policy-binding [P]   --member serviceAccount:[SA]   --role roles/bigquery.jobUser

Traps:

• Granting it on the DATA project when the error names the BILLING project. Read which project the error names.
• After fixing this, the next error is often the data half (tables.getData denied). That is expected: fix jobs.create first, then grant dataViewer on the data project.
• Service accounts in other projects querying your data need jobUser on THEIR billing project, which you may not control. Tell them which grant they need instead of guessing.

Verify: SELECT 1 succeeds as the failing identity, then the real query runs.

Verified 2026-09-26 on the BigQuery error docs (Access Denied guidance) and access-control docs: jobs.create is the billing-project permission, separate from data read permissions. The two-half model is documented.