Option C is correct because creating a custom role with precisely the necessary permissions and assigning it to the DevOps team specifically on production projects adheres to the principle of least privilege. This approach ensures the team has the access they need without exposing the organization to unnecessary security risks. Options A and B are incorrect as they grant overly broad permissions (the Project Editor role) either at the project or organizational level, which could lead to security vulnerabilities. Option D is incorrect because applying the custom role at the organizational level would grant the DevOps team access to all projects, including non-production ones, which is not required. This method is not aligned with the principle of least privilege and could introduce security risks.