diff --git a/pkg/apis/cloudruncontroller/v1alpha1/service_types.go b/pkg/apis/cloudruncontroller/v1alpha1/service_types.go
index d8c22c4..6275728 100644
--- a/pkg/apis/cloudruncontroller/v1alpha1/service_types.go
+++ b/pkg/apis/cloudruncontroller/v1alpha1/service_types.go
@@ -15,9 +15,10 @@ type ServiceSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "operator-sdk generate k8s" to regenerate code after modifying this file
 	// Add custom validation using kubebuilder tags: https://book.kubebuilder.io/beyond_basics/generating_crd.html
-	Project  string      `json:"project"`
-	Service  run.Service `json:"service"`
-	Location string      `json:"location"`
+	Project   string        `json:"project"`
+	Service   run.Service   `json:"service"`
+	Location  string        `json:"location"`
+	IamPolicy run.IamPolicy `json:"iamPolicy,omitempty"`
 }
 
 // ServiceStatus defines the observed state of Service
diff --git a/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.deepcopy.go
index 83d7407..3a66ad0 100644
--- a/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.deepcopy.go
@@ -166,6 +166,7 @@ func (in *ServiceList) DeepCopyObject() runtime.Object {
 func (in *ServiceSpec) DeepCopyInto(out *ServiceSpec) {
 	*out = *in
 	in.Service.DeepCopyInto(&out.Service)
+	in.IamPolicy.DeepCopyInto(&out.IamPolicy)
 	return
 }
 
diff --git a/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.openapi.go b/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.openapi.go
index 99367ce..5828129 100644
--- a/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.openapi.go
+++ b/pkg/apis/cloudruncontroller/v1alpha1/zz_generated.openapi.go
@@ -146,18 +146,35 @@ func schema_pkg_apis_cloudruncontroller_v1alpha1_ServiceSpec(ref common.Referenc
 			SchemaProps: spec.SchemaProps{
 				Description: "ServiceSpec defines the desired state of Service",
 				Properties: map[string]spec.Schema{
-					"service": {
+					"project": {
 						SchemaProps: spec.SchemaProps{
 							Description: "INSERT ADDITIONAL SPEC FIELDS - desired state of cluster Important: Run \"operator-sdk generate k8s\" to regenerate code after modifying this file Add custom validation using kubebuilder tags: https://book.kubebuilder.io/beyond_basics/generating_crd.html",
-							Ref:         ref("google.golang.org/api/run/v1alpha1.Service"),
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"service": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("github.com/barpilot/cloud-run-controller/pkg/run.Service"),
+						},
+					},
+					"location": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"string"},
+							Format: "",
+						},
+					},
+					"iamPolicy": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("github.com/barpilot/cloud-run-controller/pkg/run.IamPolicy"),
 						},
 					},
 				},
-				Required: []string{"service"},
+				Required: []string{"project", "service", "location"},
 			},
 		},
 		Dependencies: []string{
-			"google.golang.org/api/run/v1alpha1.Service"},
+			"github.com/barpilot/cloud-run-controller/pkg/run.IamPolicy", "github.com/barpilot/cloud-run-controller/pkg/run.Service"},
 	}
 }
 
diff --git a/pkg/controller/service/service_controller.go b/pkg/controller/service/service_controller.go
index 39ad78b..aa638c9 100644
--- a/pkg/controller/service/service_controller.go
+++ b/pkg/controller/service/service_controller.go
@@ -100,12 +100,18 @@ func (r *ReconcileService) Reconcile(request reconcile.Request) (reconcile.Resul
 		return reconcile.Result{}, err
 	}
 
+	// Be sure namespace is correctly set
+	if instance.Spec.Service.Metadata.Namespace == "" {
+		instance.Spec.Service.Metadata.Namespace = instance.Spec.Project
+	}
+
 	rm, err := run.NewRunManager(instance.Spec.Project)
 	if err != nil {
 		return reconcile.Result{}, err
 	}
 
 	parent := utils.Parent(instance.Spec.Project, instance.Spec.Location)
+	resource := utils.ServiceName(parent, instance.Spec.Service.Metadata.Name)
 
 	if r.finalizer.IsDeletionCandidate(instance) {
 		if value, exists := instance.GetAnnotations()[annotationDeletion]; exists && value == "true" {
@@ -117,12 +123,11 @@ func (r *ReconcileService) Reconcile(request reconcile.Request) (reconcile.Resul
 		r.finalizer.Remove(instance)
 		return reconcile.Result{}, r.client.Update(context.TODO(), instance)
 	}
+	r.finalizer.Add(instance)
 
-	// Be sure namespace is correctly set
-	if instance.Spec.Service.Metadata.Namespace == "" {
-		instance.Spec.Service.Metadata.Namespace = instance.Spec.Project
+	if err := rm.SetIamPolicy(resource, instance.Spec.IamPolicy); err != nil {
+		return reconcile.Result{}, err
 	}
-	r.finalizer.Add(instance)
 
 	if err := rm.CreateOrUpdate(parent, instance.Spec.Service); err != nil {
 		return reconcile.Result{}, err
diff --git a/pkg/run/run.go b/pkg/run/run.go
index 41e7066..87869db 100644
--- a/pkg/run/run.go
+++ b/pkg/run/run.go
@@ -103,3 +103,9 @@ func (rm *RunManager) Delete(parent string, service Service) error {
 	_, err := rm.service.Projects.Locations.Services.Delete(name).Do()
 	return err
 }
+
+func (rm *RunManager) SetIamPolicy(resource string, policy IamPolicy) error {
+	p := runApi.Policy(policy)
+	_, err := rm.service.Projects.Locations.Services.SetIamPolicy(resource, &runApi.SetIamPolicyRequest{Policy: &p}).Do()
+	return err
+}
diff --git a/pkg/run/service.go b/pkg/run/service.go
index f2b5953..e3921df 100644
--- a/pkg/run/service.go
+++ b/pkg/run/service.go
@@ -4,12 +4,6 @@ import (
 	runApi "google.golang.org/api/run/v1alpha1"
 )
 
-// type Service runApi.Service
-
-// type Service struct {
-// 	*runApi.Service
-// }
-
 type Service runApi.Service
 
 func (in *Service) DeepCopy() *Service {
@@ -25,3 +19,19 @@ func (in *Service) DeepCopyInto(out *Service) {
 	*out = *in
 	return
 }
+
+type IamPolicy runApi.Policy
+
+func (in *IamPolicy) DeepCopy() *IamPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(IamPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *IamPolicy) DeepCopyInto(out *IamPolicy) {
+	*out = *in
+	return
+}