A security engineer is reviewing the access control model for a multi-model Azure AI Foundry hub that manages separate AI projects for the HR team and the Finance team. The engineer needs to ensure that HR project data scientists cannot access Finance project models and vice versa, while allowing the platform admin to manage all projects. Which Azure AI Foundry access control configuration achieves this?

B is correct because Azure AI Foundry supports hierarchical RBAC where the hub admin has hub-level access while project-specific roles can be assigned at the project level. By assigning HR data scientists the 'Azure AI Developer' role scoped to the HR project and Finance data scientists to the Finance project, each team can only access their own project's resources, models, and data, while the platform admin retains hub-level access to all projects. A is incorrect because separate hubs are an overly complex solution when project-level RBAC within a single hub achieves the required isolation with less infrastructure overhead. C is incorrect because Azure Policy enforces resource configuration compliance but does not provide fine-grained user access control between AI Foundry projects. D is incorrect because Azure AI Foundry does not currently have an 'information barriers' feature equivalent to Microsoft Purview's communication isolation controls.