Needs IAM user role "Dialogflow API Admin"
little point in the documentation to explain you need to give the IAM user role "Dialogflow API Admin" not "Dialigflow API client" which it does by default. Maybe worth adding that.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information