A governance team wants supported access policies driven by governed tags rather than individually duplicating rules on every eligible object. Which capability should it evaluate?

1. A repository branch name
2. Attribute-based access control with appropriate tags and policies
3. A storage tier
4. Arbitrary notebook comments as an access engine