A batch job runs a SQL file via the bq CLI and pipes output to another process, but the bq CLI reports a permission error. How do you fix the service account permissions so the CLI can run queries?

The BigQuery Data Viewer role allows the service account to read data from BigQuery tables, which is necessary for executing queries that access data. The BigQuery Job User role enables the service account to run jobs, including query jobs, in BigQuery. Together, these roles provide the necessary permissions for the bq CLI to execute SQL queries and access the results. The BigQuery Data Editor role is incorrect because it grants permissions to modify data, which is not required for simply running a query and viewing its output. Creating a view or copying the table into a new dataset are workarounds that do not address the underlying permission issue and are inefficient compared to directly granting the correct roles.