Who should determine data access requirements for an application hosted at an organization’s data center?