Your organization has hundreds of folders and projects; only a few people should view the resource hierarchy. Assign the minimum permissions following Google best practices. What should you do?

The correct approach is to add users to a group and grant that group the roles/browser role. This aligns with Google's best practices for Identity and Access Management (IAM), which recommend using groups for permission management to simplify administration and ensure consistency. The roles/browser role provides read-only access to the resource hierarchy, including folders and projects, without granting access to the resources within them. Granting roles/browser directly to individual users is less scalable and harder to manage than using groups. roles/iam.roleViewer is incorrect because it only allows viewing IAM roles and policies, not the resource hierarchy itself. Similarly, adding users to a group and granting roles/iam.roleViewer would still not provide the necessary visibility into the resource hierarchy.