Your team is deploying a new Cloud Storage bucket that will hold thousands of objects for an internal analytics application. Security requires that access be managed centrally and consistently using only IAM policies, and they explicitly want to prevent anyone from setting per-object ACLs that could accidentally expose individual files. What should you configure when creating the bucket?