In order to create an RBAC role, I need to have all of the permissions that exist in the role, through RBAC. It doesn't matter If I have all the permissions through another authorizer.

On GKE, for example, if I want to use my Google identity to create a role, I first have to create an RBAC RoleBinding giving myself the cluster-admin role, even if I am the owner of the project that has the GKE cluster.

We should authorize role creation in a way that allows "super users" from other authorizers to use RBAC.