Set BigQuery access so each department only accesses its data; department leads can create and update tables and share them; analysts can query but not modify. How should you set access?

The correct approach is to create a dataset for each department and assign roles at the dataset level. The BigQuery Data Editor (or roles/bigquery.dataEditor) role, often referred to as WRITER in simpler terms, allows department leads to create, update, and delete tables within their specific dataset, fulfilling the requirement for them to create and update tables. The BigQuery Data Viewer (or roles/bigquery.dataViewer) role, referred to as READER, allows analysts to query data but not modify it. This granular control at the dataset level ensures each department only accesses its data. Assigning OWNER to department leads would grant excessive permissions, including managing dataset-level access, which isn't explicitly required. Assigning roles at the project level or creating tables for each department would not provide the necessary fine-grained control over data access per department.