A developer needs to create a Cloud Scheduler job that triggers a Cloud Function. The function runs as a dedicated service account named 'fn-runtime@project.iam.gserviceaccount.com'. The developer's account can create scheduler jobs but receives a permission error when configuring the job to authenticate as that service account. Following the principle of least privilege, what is the minimal IAM change to resolve the error?