Preview command fails due to missing provider read permissions

Goal: Allow Pulumi preview to complete when the configured provider lacks read‑only permissions, so users can run preview in least‑privilege environments without granting broad IAM rights.

Constraint: Preview currently invokes the provider’s read APIs to enumerate existing resources; missing permissions cause an authorization error, and substituting a mock provider or disabling plugins can hide real drift.

Uncertainty: Whether preview should approximate the diff from the stored snapshot to succeed without live calls, or must always invoke the provider to guarantee an accurate diff, leaving users to balance security against fidelity.

Should Pulumi offer a read‑only preview mode that uses the stored snapshot to approximate the diff?
What trade‑offs exist between preview fidelity and credential‑least‑privilege?
How could users opt‑in to a snapshot‑based preview without losing drift detection?