In a B2C Commerce environment, a company has implemented a role-based access control system to manage user permissions effectively. The roles defined are: Admin, Content Manager, and Customer Service Representative. Each role has specific permissions assigned to it. The Admin role can manage all aspects of the site, including user roles and permissions. The Content Manager can create and edit content but cannot manage user roles. The Customer Service Representative can view customer orders and assist with inquiries but has no editing capabilities. If a new requirement arises where the Content Manager needs to be able to view customer orders without being able to edit them, which of the following approaches would best maintain the principle of least privilege while fulfilling this requirement?