Detects when a Google Cloud Platform (GCP) service account impersonation capability is granted by a SetIamPolicy operation that adds one of three impersonation roles to a target service account: roles/iam.serviceAccountTokenCreator, roles/iam.serviceAccountUser, or roles/iam.serviceAccountOpenIdTokenCreator. Such grants allow minting tokens or acting-as the service account, enabling privilege escalation and durable, keyless persistence. The rule uses Google Cloud Audit Logs (gcp.audit) to identify a successful SetIAMPolicy call where a binding delta is added (action: ADD) for one of the impersonation roles. Implemented as a New Terms rule, it alerts when the granting principal (user.id) is observed for the first time performing this action within a history window (now-10d). This helps surface novel or anomalous impersonation grants that could indicate attacker activity or misconfiguration. The rule maps to MITRE ATT&CK techniques T1098 (Account Manipulation) and T1098.003 (Additional Cloud Roles), under Persistence and Privilege Escalation. It includes triage guidance, potential false positives, and remediation steps.