A security operations team must retain a subset of workload logs in a specific geographic region for an industry-specific compliance requirement, while also applying customized retention periods and access controls to those logs. Which Cloud Logging capability directly supports this requirement?