Also, maybe for single owner, we should automatically assigned IAM (not just owner) and simple migration to the role list,