The most precise and best way to implement this requirement in Pega is by using its Role-Based Access Control (RBAC) model. Option C provides the specific, actionable steps for this implementation: creating a dedicated access role (HRApp:SeniorExec), assigning it only to the authorized senior executive users, and then granting the necessary privileges to access the sensitive reports directly to that role. This approach ensures a clear, maintainable, and secure design by directly linking a user's business function to their system permissions, which is a core Pega security best practice.

A: This option is too general. While correct that an RBAC system is needed, option C describes the specific Pega implementation of that system, making it a more precise and superior answer.

B: The Access Control Check is a static analysis tool used to audit and identify potential security vulnerabilities in rules. It does not implement or enforce access control policies.

D: Data masking is a technique to obscure sensitive data fields within a report or UI. It does not control or restrict access to the entire report object itself.

1. Pega Platform™ 8.8 Help - "Creating an access role": This document outlines the process of creating an Access Role object

such as HRApp:SeniorExec

to define a set of permissions for a group of users with a common business function. This directly supports the action described in option C.

2. Pega Platform™ 8.8 Help - "Granting privileges to an access role": This guide explains how to use an Access of Role to Object (ARO) rule to grant specific permissions (e.g.

view

run) for a class

such as the one containing the reports

to a specific access role. This is the mechanism for the second part of option C.

3. Pega Platform™ 8.8 Help - "Authorization in Pega Platform": This document describes Pega's authorization models

emphasizing RBAC as the primary model. It states

"In a role-based access control model

privileges are grouped into roles that are assigned to users

" validating the approach in option C as the standard method.