A hospital wants nurses to access only the patient records relevant to their job function, and access should update automatically whenever a nurse is assigned to a different unit. Administrators do not want individual data owners deciding who gets access, and there are no security classification labels on the records. Which access control model best fits these requirements?