A new team member needs to be able to view all resources in a project, but should not be able to modify them. You want to follow the principle of least privilege.

Which IAM role should you assign?

The predefined `roles/viewer` role grants read-only access to resources within a project. It is preferred over the legacy primitive `Viewer` role. The `roles/browser` role is too restrictive (only sees the project name), and a custom role is too difficult to maintain for general read access.