Instead of configuring each employee separately, set up the group role analytics_team. Allow analytics_team to read orders, then make analyst_a a member of that role.