An organization wants resource permissions to depend on department, data classification and device compliance. Which model best fits?

1. Discretionary access based only on ownership
2. An unrestricted mandatory administrator role
3. Attribute-based access control
4. A shared password for each classification