gcloud projects add-iam-policy-binding my-project-123456 --member serviceAccount:deploy-bot@my-project-123456.iam.gserviceaccount.com --role roles/storage.objectAdmin

Gives deploy-bot the storage.objectAdmin role on the whole project, letting it manage buckets and objects everywhere in my-project-123456. Members can also be users (user:email) or groups (group:email), and --condition can scope the grant further. Remove the grant with gcloud projects remove-iam-policy-binding.