A security engineer is reviewing the access control model for a multi-model Azure AI Foundry hub that manages separate AI projects for the HR team and the Finance team. The engineer needs to ensure that HR project data scientists cannot access Finance project models and vice versa, while allowing the platform admin to manage all projects. Which Azure AI Foundry access control configuration achieves this?

The correct configuration is to create projects within a single AI Foundry hub and assign role-based access at the project level, not the hub level, for data scientists. Azure AI Foundry supports hierarchical RBAC where the hub admin has hub-level access while project-specific roles can be assigned at the project level. By assigning HR data scientists the 'Azure AI Developer' role scoped to the HR project and Finance data scientists to the Finance project, each team can only access their own project's resources, models, and data, while the platform admin retains hub-level access to all projects. The configuration that creates two separate Azure AI Foundry hubs, one per team, with separate managed identities and RBAC assignments is incorrect because separate hubs are an overly complex solution when project-level RBAC within a single hub achieves the required isolation with less infrastructure overhead. The configuration that uses Azure Policy to deny cross-project model access within the AI Foundry hub is incorrect because Azure Policy enforces resource configuration compliance but does not provide fine-grained user access control between AI Foundry projects. The configuration that enables Azure AI Foundry information barriers between HR and Finance projects is incorrect because Azure AI Foundry does not currently have an 'information barriers' feature equivalent to Microsoft Purview's communication isolation controls.