Charles has been tasked with writing policies for an organization that has never really had any formalized internal governance structure. He needs to write a policy that covers the requirements for getting an administrative account since the organization wants to reduce the number of users with administrative accounts in the organization. Which of the following policies should he write to address this issue?