Would be great to add support for fine-grained access controls by supplying a database role when connecting. Could supply this via a connection string argument like

create_engine(
    "spanner+spanner:///projects/project-id/instances/instance-id/databases/database-id",
    connect_args={"database_role": "role_name"}
)

This should be do-able once this PR merges, adding datbase_roles option to the underlying dbapi:
googleapis/python-spanner#1338