Under Database Access > Database Users you should see a toggle “Restrict Access to Specific Clusters/Federated Database Instances/Stream Processing Instances” which shows “Enable to specify the resources this user can access. By default, all resources in this project are accessible.” ← if you enable this you can scope a database user to a specific cluster (for example)