In a large organization, the IT department is tasked with implementing Role-Based Access Control (RBAC) to manage user permissions effectively. The organization has three roles: Admin, Manager, and Employee. Each role has specific permissions associated with it. The Admin role can create, read, update, and delete records; the Manager role can read and update records; and the Employee role can only read records. If a new project requires that certain sensitive records be accessible only to Managers and Admins, what is the most effective way to implement this access control while ensuring that Employees cannot access these records?