the role template is Owner, Admin, a guest's, or carries org.admin or role.manage
create_service_account
update_service_account