An organization is deploying an Azure OpenAI model to internal users and wants to ensure that all content filtering settings cannot be modified by the AI development team once set. Only the security team should be able to change content filter configurations. Which RBAC approach enforces this?

B is correct because the 'Cognitive Services OpenAI User' role grants only data plane inference access (submitting prompts, reading completions) without management plane permissions to modify model deployments or content filter configurations. The security team holds the 'Cognitive Services Contributor' role, which includes management plane permissions to configure content filters. This RBAC separation ensures developers cannot change content filter settings. A is wrong because 'Cognitive Services OpenAI Contributor' is a data plane role for inference; neither this nor 'OpenAI User' by itself prevents management plane changes without the correct role scope. C is wrong because Azure Policy can deny specific operations but cannot effectively differentiate between individual user/service principal identities versus security team members without complex custom policy logic. D is wrong because resource locks prevent deletion and modification by everyone including the security team, making it impossible for the security team to update content filters legitimately.