A service provider must give its NOC read-only visibility, its senior engineers full configuration rights, and its customer tenants access only to their own VPN data while logging every change. The platform is SD-WAN Manager with multiple organizations sharing controllers. Which user-group and role-based access design enforces the tenancy requirement?

The correct design succeeds because SD-WAN Manager multitenancy combines provider-level user groups with role scopes and VPN or tenant resource limits that give NOC read-only monitoring, give senior engineers full configuration, confine each tenant to only its own VPN inventory, templates, policies and statistics across GUI and API on shared controllers, and record actions in audit logs. The shared-VPN logging design correctly provides differentiated NOC and engineering privileges with centralized audit on shared infrastructure but authorizes visibility across all VPNs, so organization isolation fails and tenants could view each other's data. The session-visibility design correctly provides differentiated privileges and tenant-scoped views for all sessions but emphasizes authorization without persistent accounting, so the mandate to log every change for attribution and compliance remains unmet. The dedicated-cluster design correctly provides isolation, differentiated privileges and full logging by deploying a separate Manager per tenant, yet it contradicts the premise of multiple organizations sharing controllers and destroys scalability and centralized provider operations. For exams, separate Manager multitenancy from device CLI AAA with TACACS or RADIUS and treat tenant or VPN scope plus shared controllers as decisive cues rather than choosing generic RBAC alone; operationally, validate under Administration by logging in as each test user to confirm NOC cannot commit, engineers can, tenants see only assigned VPNs, and each action appears with user and timestamp in audit logs.