A data engineering team needs to allow Unity Catalog to read and write files in a specific ADLS Gen2 container so they can create external tables backed by that path. They have already created a storage credential that references a managed identity with access to the storage account. What must they create next so Unity Catalog can govern access to that specific storage path?