Universal containers would like to create a custom team solution that can be used on a custom loan object. the following requirements must be met: the loan custom object should be set to private in the org-wide defaults. any user added to the custom team object should have read only access to the corresponding loan record. if the custom team record is marked as "primary" then the corresponding user should have read/edit access to the corresponding loan record. which two methods will allow the architect to meet the requirements?