How does the Grant Access Using Hierarchies setting on an object interact with the role hierarchy, and what data model design considerations arise when it must be disabled for sensitive objects?