With regard to Google Cloud Platform (GCP) and G Suite.

What are the current best practices when setting up service Authentication and Authorization for: owners, administrators, developers, end-users, etc.?

For example, in AWS I would never use the Root account instead having a separate ("bastion") IAM account that other service accounts/groups could query to retrieve transient tokens to authorize actions. Besides restricting the various accounts/groups to least privilege. I would further ensure CloudWatch is logging all access and configured to both alert and possibly execute a Lambda script on suspicious activities.

I would appreciate as specific advise as possible[1], since I'm not aware of all the features and configurations available to GCP/G Suite.

[1] admittedly my example isn't representative of this, but that is because I don't have much experience in AWS either.