A company is setting up a new Amazon SageMaker Unified Studio domain.

Option D is correct because domain units in Amazon SageMaker Unified Studio are specifically designed to organize assets and other domain entities by business unit or team, while also enabling delegated authority to domain unit owners for authorization and governance. AWS states that domain units let selected users within each business unit log in and share assets to the catalog, and that users elsewhere in the enterprise can discover those assets and request access. This directly matches the requirement for isolated control with controlled cross-business-unit sharing upon approval. AWS also documents that Unified Studio supports authentication through AWS IAM Identity Center, which satisfies the need for centralized authentication and identity mapping.

Option A is incorrect because API keys are not the correct authentication model for Unified Studio portal access; AWS documents IAM Identity Center and related identity-provider-based sign-in instead. Option B is wrong because it prevents the required approved sharing. Option C is less suitable because the requirement is to isolate business units within a domain while still enabling governed sharing; separate domains would add more separation than needed and complicate sharing. Therefore, one domain with separate domain units, IAM Identity Center, and access-request-based sharing is the best fit.