Diagnose: does not have bigquery.jobs.create permission in project

TL;DR

Run SELECT 1 as that identity: if it fails the same way, it is purely the jobs.create grant, not your SQL. Check your client's project setting.

Steps

1. Symptom: "Access Denied: Project [P]: The user/service account does not have bigquery.jobs.create permission in project [P]."
2. Cause: the identity cannot create query jobs billed to project [P]. This is the "who pays" permission, independent of "who can read the data".
3. Confirm:
4. Identify [P] in the error. Is that the project you meant to bill? Check your client's project setting.
5. gcloud projects get-iam-policy [P] - look for your identity with bigquery.jobUser or a role containing jobs.create.
6. Run SELECT 1 as that identity: if it fails the same way, it is purely the jobs.create grant, not your SQL.
7. Fix: grant roles/bigquery.jobUser on [P] to the identity:

gcloud projects add-iam-policy-binding [P] --member serviceAccount:[SA] --role roles/bigquery.jobUser

5. Traps:

• Granting it on the DATA project when the error names the BILLING project. Read which project the error names.
• After fixing this, the next error is often the data half (tables.getData denied). That is expected: fix jobs.create first, then grant dataViewer on the data project.
• Service accounts in other projects querying your data need jobUser on THEIR billing project, which you may not control. Tell them which grant they need instead of guessing.

6. Verify: SELECT 1 succeeds as the failing identity, then the real query runs.

When to use

You are seeing this: Symptom: "Access Denied: Project [P]: The user/service account does not have bigquery.jobs.create permission in project [P]." Cause: the identity cannot create query jobs billed to project [P]. Use this skill when you run into "Diagnose: does not have bigquery.jobs.create permission in project".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the BigQuery error docs (Access Denied guidance) and access-control docs: jobs.create is the billing-project permission, separate from data read permissions. The two-half model is documented.