in an environment where administrators, the accounting department, and the marketing department all have different levels of access, which of the following access control models is being used?