A Chief Information Security Officer $($CISO$)$ has signed off on a security policy for her organization. She would like to use an approach that forbids most activity except for those on a small designated list. Which permission level is she planning to use?