Your SOC uses Microsoft Sentinel deployed in a Log Analytics workspace. A junior analyst needs to triage incidents, investigate them, and run playbooks manually from within incidents, but must not be able to modify analytics rules, edit workspace settings, or change data connectors. Following least-privilege principles, which role assignment should you grant?