A financial services company is moving sensitive workloads to Google Cloud. Their compliance team wants a way to see near-real-time logs whenever a Google support or engineering employee accesses their content, including the reason for that access, so they can independently verify that provider staff are not viewing data without justification. Which Google Cloud capability directly meets this requirement?