You are managing a BigQuery dataset named "customers" for a company called NextData Corp . All tables in this dataset will be tagged using a Data Catalog tag template named "gdpr" , which includes one required boolean field called "has_sensitive_data" . Every employee should be able to perform simple searches to find tables where this field is either true or false . However, only the People Operations team should have access to view data within tables where "has_sensitive_data" is marked as true . You have already granted the bigquery.metadataViewer and bigquery.connectionUser roles on the dataset to the All Employees group. You want to reduce configuration complexity. What should you do next?