A Foundry project lead wants to let a new data scientist run experiments and view results inside one specific Foundry project, but must prevent that person from changing the project's content filtering policies or deleting deployments. What should the lead do?

The correct answer is A. Assigning the data scientist a scoped Azure role limited to that single Foundry project, one that grants contributor-level access for running experiments and viewing results but withholds administrative actions, lets the person do their job while the project lead retains sole control over sensitive settings like content filtering policies and deployment deletion. Option B is incorrect because sharing subscription owner credentials grants unrestricted control over every resource in the subscription, far beyond the one project the data scientist needs, and violates the principle of least privilege. Option C is incorrect because giving someone the same administrative role as the lead and simply asking them not to use certain permissions relies on trust rather than an enforced boundary; nothing technically prevents an accidental or unauthorized change. Option D is incorrect because disabling content filtering entirely removes a safety control for everyone using the deployment just to avoid one person changing it, trading a real protection for a false sense of simplicity rather than restricting who can edit it.