A developer needs an application running on their laptop to temporarily act as a service account named 'batch-runner@project.iam.gserviceaccount.com' to call BigQuery, without downloading a long-lived JSON key. Your security policy prohibits creating service-account keys. Which role must you grant the developer's user account on the service account so they can generate short-lived credentials for it?