When reading from a Dataflow source or writing to a Dataflow sink using DirectPipelineRunner, the Cloud Platform account that you configured with the gcloud executable will need access to the corresponding source/sink Reference:
https://cloud.google.com/dataflow/java-sdk/JavaDoc/com/google/cloud/dataflow/sdk/runners/ DirectPipelineRunner

https://cloud.google.com/sql/docs/mysql/manage-connections

First we need to know who is accessing what then we can create suitable policies. Stackdriver is used to track access logs for Bigquery.

Using customer-managed encryption keys ensures that access to the underlying encrypted data is entirely controlled by key availability. When an employee leaves, deleting or disabling the encryption key immediately renders the sensitive data unreadable, providing a strong, irreversible control that satisfies strict data privacy and data invalidation requirements beyond access revocation alone.