A media streaming company serves premium video segments (thousands of small HLS chunk files per title) from a Cloud Storage bucket fronted by an external HTTP(S) load balancer with Cloud CDN enabled. Only authenticated, paying subscribers may access these files, and each subscriber's session grants access to many files under a common URL path prefix. The security team wants to avoid generating and managing a separate token for every individual file request. Which access-control mechanism should the architect configure?