The correct answer is D because it aligns with Google's recommended practice for service accounts to access user data without storing user credentials. Domain-wide delegation allows a service account to impersonate users within the G Suite domain, enabling the application to access each user's Google Drive on their behalf securely. This method avoids the security risks of handling user credentials directly. Options A and B are incorrect as they grant users the ability to impersonate the service account, which is the reverse of the requirement. Option C is unsuitable because using a dedicated G Suite Admin account does not provide user-specific access and violates the principle of least privilege. Although one comment questions domain-wide delegation, the consensus and official documentation support it as the appropriate solution for this scenario.