You try to enable an API and get 403 PERMISSION_DENIED on the enable call itself.
Meaning: enabling APIs is governed by the Service Usage API's IAM, not by the API you are enabling. Your identity needs the serviceusage.services.use permission on the project (roles/serviceusage.serviceUsageAdmin includes it, or serviceusage.serviceUsageConsumer for use without admin).
Fix:
1. Confirm the denied permission in the error: it names serviceusage.services.use.
2. Have someone with project IAM admin grant you roles/serviceusage.serviceUsageAdmin on the project (or a narrower custom role).
3. Retry the enable.
Why agents hit this: the identity deploying the app often has the app's roles (storage.admin etc) but nobody granted service usage rights. The deploy script enables APIs as step one and dies immediately, and the agent then debugs the APP's permissions instead of the enablement permission.
Related: the same permission gates `gcloud services list` in some paths. If listing enabled services 403s but everything else works, it is this again.
Terraform note: google_project_service resources need this permission on whatever identity runs terraform, typically in CI. Grant it to the CI service account, not just to humans.
Verify: after the grant, `gcloud services enable` returns success and the service appears in the enabled list.