You have an Azure subscription that contains a Microsoft Foundry hub named Hub1, an Azure OpenAI resource named resource1, and a user named User1.

You need to ensure that User1 can create a new Azure Content Understanding in Foundry Tools project in Hub1. The solution must follow the principle of least privilege.

Which role should you assign to User1?