A business unit within a multinational corporation subscribes to GCP and begins migrating workloads to the platform. The business unit establishes a Cloud Identity domain with an organizational resource housing numerous projects. Your team learns of this and seeks to assume responsibility for managing permissions and auditing the domain resources. Which type of access should your team be granted to fulfill this requirement?