You can restrict different services to different users, or if using containers, give access based on which container. IAM is not the only way to have shared, controlled access.