Role analyst must read the users and orders marts, while payment data in payments is blocked by security policy. Configure minimum access: read-only, and only for those two tables.