A user successfully authenticates but must not access the payroll administration page. What should enforce that restriction?

1. Only requiring a password on the login page
2. An appropriate authorization scheme on the protected page and operations
3. Only removing the payroll navigation entry
4. Only changing the payroll page title