You want a shared dataset of readable-but-unmodifiable tables for analysts, plus private per-analyst workspaces in the same project where analysts can create tables visible only to themselves. How should you grant roles and organize datasets?

The correct approach is to grant the BigQuery Data Viewer role on the shared dataset. This allows all analysts to read the unmodifiable tables. For private workspaces, create a separate dataset for each analyst. Then, grant each analyst the BigQuery Data Editor role only on their specific dataset. This ensures they can create and manage tables within their private workspace, visible only to them, without affecting other analysts' private spaces or the shared dataset. Incorrect options: Granting project-level roles is too broad and violates the principle of least privilege. Giving all analysts editor access to a single "other dataset" would make that dataset shared and modifiable by everyone, not private per analyst.