bigquery iam permissions not updatable

I have an existing environment which I've created and managed via Deployment Manager, including a BigQuery dataset and several tables.

A requirement came up where I needed a new service account which needed permissions on the BigQuery dataset, so I added the service account and adjusted the dataset's `accessControl` policy in my jinja template.

```yaml
resources:
#...
- name: my_dataset
type: bigquery.v2.dataset
accessControl:
gcpIamPolicy:
bindings:
- role: 'roles/bigquery.dataOwner'
members:
- "serviceAccount:polyglot-sync@{{ properties["project"] }}.iam.gserviceaccount.com"
- role: 'roles/bigquery.jobUser'
members:
- "serviceAccount:polyglot-sync@{{ properties["project"] }}.iam.gserviceaccount.com"
#...
```

The service account created successfully, but I received an error when DM tried to deploy the new accessControl policy:

```
- code: NO_METHOD_TO_UPDATE_ACCESS_CONTROL
location: /deployments/sre-staging-17/resources/my_dataset
message: No method found to update access control on resource 'my_dataset' of type
'bigquery.v2.dataset'.
```

Surely accessControl policies will always be subject to change? Having them non-updatable seems unbelievable. Have I just misunderstood something, or is there another way to achieve this please?