Your SOC is integrating Google Threat Intelligence (GTI) Enterprise into your Google SecOps deployment. Threat analysts need to pivot on IOCs and view full malware behavioral reports directly from within SecOps, while a separate group of junior triage staff should only see whether an IOC matched a known threat during alert investigation, without access to the raw GTI portal or detailed adversary attribution. Which configuration approach best satisfies both requirements while minimizing unnecessary tool exposure?