Oracle Logging explicitly states that searching indexed logs requiresread access to the log group and read permission on log content. The documented policies are allow group GroupA to read log-groups in tenancy and allow group GroupA to read log-content in tenancy. The read log-content permission grants LOG_CONTENT_READ, which enables users to inspect service and custom log contents and execute searches. manage log-groups is unnecessarily privileged because it allows administrative operations on logging resources. inspect does not provide sufficient access to actual log content, while use log-content is commonly associated with log ingestion and agents rather than least-privilege read-only searching. Therefore, B precisely implements the minimum permissions required for the security-auditors group to use OCI Logging Search.