A new data engineer joins your team and needs to create and manage warehouses, databases, and roles across the account, but company policy strictly forbids granting anyone the ability to view billing information or manage account-level parameters unless they are a designated administrator. Which approach best follows Snowflake's principle of least privilege while meeting these requirements?