Pick the smallest built-in Azure role for a given data-plane task. Covers blob / queue / Service Bus / Cosmos DB / Key Vault / ACR. Notes the Contributor-doesn't-cover-DataActions trap, the Cosmos native-RBAC exception, and how to inspect effective role assignments.
