Group B requires access to all data except the 'restricted' namespace. Which data access scope design would satisfy this?

• A. Create a new data access scope to include all data with a 'restricted' label.
• B. Create a new data access scope to allow excluding a specific namespace.
• C. Use a global data access scope with no exclusions.
• D. Create a new data access scope to allow all data and exclude 'restricted' namespace for Group B; assign in IAM.

Answer: (D)

Fine-grained access control with data scopes lets you grant broad access while explicitly excluding certain areas. The best design here is to create a data access scope that permits all data but excludes the restricted namespace, then assign that scope to Group B in IAM. This directly gives Group B access to everything except the restricted namespace, satisfying the requirement.

Why this works: it combines an inclusive scope (all data) with a clear exclusion (the restricted namespace), enforcing the exact limitation through IAM. Creating a scope that includes restricted data would violate the constraint. A scope that excludes a namespace without tying it to the specific restricted one could be ambiguous, and a global scope with no exclusions would grant access to the restricted data as well. Attaching the scope in IAM ensures consistent enforcement across resources for the group.