On-call staff need a ServiceAccount that can inspect Pods and Deployments in the billing namespace for troubleshooting but must not delete or mutate them. Which Role verb set best matches least privilege?

RBAC verbs finely control what a subject may do. Read-oriented troubleshooting typically needs get, list, and watch. Mutating verbs such as create, update, patch, and delete, or privilege-escalating verbs like bind, escalate, and impersonate, exceed a read-only support account. Least privilege Roles list only the verbs required for the job.