At universal containers, users should only see accounts they or their subordinates own. all accounts with the custom field "kay customer" should be visible to all senior account managers. there is a custom field on the account record that contains sensitive information and should be hidden from all users, except 3 designated users who require view and edit access. these three users come from different user groups, and will change occasionally. which three platform security features are required to support these requirements with the minimum amount of effort