Your team is developing an application in Google Cloud that executes with user identities maintained by Cloud Identity. Each of your application's users will have an associated Pub/Sub topic to which messages are published, and a Pub/Sub subscription where the same user will retrieve published messages. You need to ensure that only authorized users can publish and subscribe to their own specific Pub/Sub topic and subscription. What should you do?

A. Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level. B. Grant the user identity the pubsub.publisher and pubsub.subscriber roles at the project level. C. Grant the user identity a custom role that contains the pubsub.topics.create and pubsub.subscriptions.create permissions. D. Configure the application to run as a service account that has the pubsub.publisher and pubsub.subscriber roles.