To make sure that all customers can access only approved resources, marie is auditing her public cloud identity systems. She wants to control specific access and operations. What is marie defining?