An organization needs to control access to its datasets in BigQuery to comply with specific data privacy regulations. They want to ensure that only users with legitimate business reasons can access specific fields within tables containing sensitive information. Which of the following actions should the organization take?