D. Assignment type to Eligible:

When you set the assignment type to "Eligible," it means that users will not have permanent access to the role but will be eligible for it. They will need to activate the role when required, and it won't be active by default. This approach allows you to enforce just-in-time access, meaning that users will only have access to the Security administrator role when they request and activate it through PIM. Once their role activation period ends, they will lose access to the role automatically.