A data engineer creates a SQL user-defined function (UDF) called finance.reporting.mask_ssn in Unity Catalog that analysts will call inside their queries. The analysts already have USE CATALOG on finance and USE SCHEMA on finance.reporting. When the analysts try to invoke the function, they receive a permission error. Which single grant will allow the analysts to run the function?