As part of maintaining the organization's security posture, you must enforce granular, dynamic access controls to Google Cloud resources based on a user's identity and the context of each request, without deploying a traditional VPN. Which Cloud Identity capability meets this requirement?