Which of the following is the MOST appropriate approach for implementing access control that will facilitate security management of the VoIP web application?