the role template is neither shipped nor the org's own
create_service_account
get_data_policy
grant_unit_role
resolve_identity_finding
set_data_policy
set_sso_policy
update_service_account