An enterprise is designing a multi-environment data processing architecture across separate Development and Production Google Cloud environments. The architecture must satisfy the following governance and compliance requirements: Data Classification and Access Control: A centralized taxonomy must classify sensitive personally identifiable information (PII). Production analysts with explicit clearance must be able to view cleartext values, while developers and testers in the development environment must only see masked data. Cryptographic Security: All persistent data in BigQuery datasets and Cloud Storage buckets must be encrypted using Customer-Managed Encryption Keys (CMEK) via Cloud KMS/Cloud HSM, with strict cryptographic key isolation between environments. Lifecycle Management: Development storage buckets must automatically delete intermediate test data older than 30 days to limit exposure and reduce costs, whereas production audit data must be retained under an immutable compliance policy. Which combination of architectural controls and services best satisfies these requirements?

Define a centralized policy tag taxonomy with dynamic data masking in a shared governance project; grant the Fine-Grained Reader role exclusively to cleared production analysts while withholding it in development. Provision isolated Cloud KMS CMEK keys for each environment. Configure Cloud Storage Object Lifecycle Management with age-based deletion rules for development buckets, and enforce locked Bucket Retention Policies on production buckets.: ### What the solution is This architecture establishes an enterprise-grade governance foundation that enforces uniform data classification, fine-grained access security, strong cryptographic isolation, and automated lifecycle policies across distinct environments. ### How it meets Data Classification and Access Control - **Standardized Taxonomy & Dynamic Data Masking**: By defining policy tags in a centralized data governance project and applying them across BigQuery columns, schema classification remains uniform across both environments. - **Role-Based De-identification**: BigQuery dynamic data masking evaluates permissions at query runtime. Users lacking the **Fine-Grained Reader** (`roles/datacatalog.categoryFineGrainedReader`) role (such as development and testing personnel) automatically receive masked column values (e.g., nullified, hashed, or partially redacted), while authorized production data analysts with the role view cleartext data. ### How it meets Cryptographic Security - **CMEK Isolation**: Using distinct **Cloud KMS** / **Cloud HSM** Customer-Managed Encryption Keys per environment guarantees cryptographic boundary separation, ensuring development workloads cannot access or impact production key material. ### How it meets Lifecycle Management - **Development Deletion Rules**: Cloud Storage **Object Lifecycle Management** uses native rules (such as `Age: 30` with `Delete` action) to purge obsolete test datasets automatically without manual intervention. - **Production Immutability**: Production compliance and audit data are protected by **Bucket Lock** retention policies, ensuring data cannot be overwritten or prematurely deleted before the regulatory retention duration expires. ### Key advantages - Eliminates code differences between environments by enforcing masking dynamically at query runtime rather than rewriting schemas. - Minimizes the risk of production key compromise by isolating KMS key rings across folders and projects. - Automates storage optimization and regulatory compliance through declarative lifecycle policies. ### Why this is optimal This approach leverages native Google Cloud governance tools (Dataplex / Data Catalog policy tags, BigQuery dynamic data masking, Cloud KMS, and Cloud Storage lifecycle management) to maintain strict security boundaries while preserving pipeline operational consistency between development and production.