A security consultant needs to change the organization’s identity and access management model. The new approach will place responsibility with the owner, who will determine which users can access which resources. Which low-cost model must be used for this purpose?