A financial analytics firm stores customer records in a cloud data warehouse. During a quarterly review, the security team maps controls to each phase of the cloud data lifecycle. They note that while data is actively being queried and processed by analysts and BI tools, the primary risk is unauthorized viewing or manipulation by users who have legitimate system access but should not see certain fields. Which control set is MOST appropriate to emphasize for this specific lifecycle phase?