Dataset 'customers' uses a Data Catalog tag template 'gdpr' with mandatory boolean field has_sensitive_data. All employees must be able to search tables by that tag value, but only the HR group may read table data when has_sensitive_data=true. All employees already have bigquery.metadataViewer and bigquery.connectionUser on the dataset. To minimize config, what do you do next?

The correct option ensures all employees can search by the tag and only HR can read sensitive data while minimizing configuration. Creating the tag template with public visibility allows all employees to search for tables using the 'gdpr' tag and its values, fulfilling the search requirement without needing additional datacatalog.tagTemplateViewer roles. Assigning the bigquery.dataViewer role to the HR group specifically on tables with hassensitivedata=true grants them read access to that data, as required. Incorrect options: Private visibility for the tag template would prevent all employees from searching by the tag, as only the creator and specific viewers could see it. Assigning datacatalog.tagTemplateViewer to all employees is redundant when the template is public, as public templates are visible to all by default.