You manage Identity and Access Management (IAM) for your Google Cloud project.

The correct answer is A because access should be managed through groups and granted with the least privilege required. The container.developer role is appropriate for users who need to work with Kubernetes resources and deploy applications without administering the full GKE environment or broader Google Cloud project. Adding the user to an existing cloud-developer group also simplifies access management because future joiners and leavers can be handled by group membership rather than individual IAM bindings. The container.admin role is too broad because it allows cluster administration. The container.serviceAgent role is intended for Google-managed service agents, not human developers. The Editor role is also excessive because it grants wide project-level permissions unrelated to GKE deployment.