Your company operates an e-commerce business on Google Cloud Platform (GCP). The payment processing application generates structured JSON logs with the schema.

The jsonPayload.user_email field contains personally identifiable information (PII), and the security team requires that only they have access to this field. The engineering team must retain access to non-PII log data for operational purposes. How should you configure GCP to prevent the engineering team from accessing PII while allowing the security team exclusive access to the user_email field?