A new auditor joins your organization and you need to add him to your team's Google Cloud project. The auditor needs to have read access permissions but should be restricted from modifying resources in the project. How should you grant the necessary permissions to the new auditor?