Status: OUT
GCP's dual security governance (IAM access control + CMEK data control) combined with KMS operational safety (duty-separated, non-disruptive rotation) achieves effective layered defense where compromise of one governance surface does not compromise the other and routine operations cannot accidentally breach either.