To assign a user or group to a workspace or project via the API, I have to invent and supply a metadata.name for the binding itself, on top of specifying who (subject), what (targetRef), and which role (roleRef). This name doesn't correspond to anything meaningful, it's not the user, the workspace/project, or the role, it's just busywork I have to do every single time I create a binding. It makes scripting and automating user/group assignments more tedious than it needs to be.