In Snowflake, privileges go to roles, and roles go to users and to other roles. A role granted to another passes its privileges up: in this account ANALYST is granted to ENGINEER, and ENGINEER to SYSADMIN, so SYSADMIN can do everything below it.
To read a table, a role needs three grants: USAGE on the database, USAGE on the schema, and SELECT on the table. Miss any of them and the table "does not exist or not authorized".
GRANT USAGE ON DATABASE ridgeline TO ROLE marketing;
GRANT USAGE ON SCHEMA ridgeline.web TO ROLE marketing;
GRANT SELECT ON ALL TABLES IN SCHEMA ridgeline.web TO ROLE marketing;
ON ALL TABLES covers the tables that exist now; ON FUTURE TABLES covers ones created later. SHOW GRANTS TO ROLE x lists a role's grants. Creating roles takes ACCOUNTADMIN here (SECURITYADMIN or USERADMIN in larger accounts). Grant new roles to SYSADMIN so administrators can manage what they create.