An organization is deploying a new data lake that will centralize records from several applications. During the design phase, the security architect identifies the following requirements:

• The sensitivity levels of the data is different.

• The data must be accessed through stateless API calls after authentication.

• Different users will have access to different data sets.

Which of the following should the architect implement to best meet these requirements?