Christopher is designing a security policy for his organization. he would like to use an approach that allows a reasonable list of activities but does not allow other activities. which permission level is he planning to use?