Allow users to query BigQuery datasets but prevent dataset deletion, following Google-recommended IAM practices. What should you do?

The correct answer is to create a custom role that removes delete permissions, add users to a group, and grant the group that custom role. This follows the principle of least privilege by creating a role with only the necessary permissions (querying, not deleting). Granting the role to a group simplifies user management, aligning with Google's recommended IAM practices for scalability and auditing. Assigning roles/bigquery.user or roles/bigquery.dataEditor would not work because these predefined roles still include permissions that could allow data manipulation beyond just querying, or they might not explicitly prevent deletion in all contexts, or they might grant too many other permissions. Creating a custom role is necessary to precisely control permissions. While creating a custom role is a good start, directly assigning it to individual users is less scalable and harder to manage than using groups.