This rule detects the creation of a RoleBinding or ClusterRoleBinding in Google Kubernetes Engine (GKE) where the binding references a ServiceAccount, which can enable privilege delegation or RBAC misconfigurations leading to elevated access. It ingests GCP Audit data (data_stream.dataset:gcp.audit) and requires service.name:k8s.io with event.action matching rolebindings.create or clusterrolebindings.create and event.outcome:success, while filtering out benign bootstrap bindings. The detection focuses on subjects of kind ServiceAccount and excludes known system accounts (for example, client.user.email: system:apiserver or gcp:kube-bootstrap). The rule is intended to surface cases where an attacker or misconfiguration binds elevated roles to an existing workload service account.