A cybersecurity operations team is tasked with refining the firewall policy for a financial institution\'s critical database cluster. They need to guarantee that authorized administrators from the \"SecOps_Admin\" group can exclusively access this cluster via SSH and HTTPS for maintenance, while all other internal and external traffic attempting to access the cluster on these ports should be explicitly denied. A broad, overarching policy at the bottom of the rulebase denies all traffic to the database cluster that hasn\'t been explicitly permitted by preceding rules. Considering the FortiGate\'s sequential policy evaluation, which placement of the \"SecOps_Admin\" allow rule would most effectively achieve this objective and prevent unintended access or denial?