Which of the following specifies the authorization classification of information asset an individual user is permitted to access, subject to the need$-$to$-$know principle?

Sensitivity levels

Security clearances

Discretionary access controls

Task$-$based access controls