You have implemented VPC Service Controls to protect your BigQuery datasets. A data scientist working from home needs to query the data using the BigQuery web UI. Their home IP address is dynamic. How can you grant them access without compromising the security perimeter?

VPC Service Controls relies on Access Context Manager to define 'Access Levels'. Since the IP address is dynamic, you cannot use IP whitelisting. Instead, you define an Access Level based on identity (BeyondCorp Enterprise) and device posture (e.g., requiring a company-issued laptop with screen lock enabled). You then attach this Access Level to the VPC-SC perimeter, allowing the data scientist secure access from anywhere.