The answer comes from Salesforce's separation of responsibilities. Use A. Public Groups; D. Roles and Subordinates; E. Users. The selected option is not chosen because it sounds familiar; it is chosen because it gives Salesforce the right instruction at runtime. Manual record sharing can grant access to individual users, public groups, and roles with subordinates. It is a record-level access mechanism, separate from field-level security and permission set assignment.
The scenario describes a business outcome, not merely an administrative preference. If the feature is configured correctly, users get the intended result without depending on memory, spreadsheets, or manual policing. That is the professional standard for Platform App Builder work: place the rule in metadata, test it under the correct permissions, and keep the design supportable.
The alternatives are plausible only if the requirement is read too narrowly. B (Private Groups) would be fragile here because it could produce an inconsistent result once different users, records, or apps are tested. C (Permission Set Groups) does not fit cleanly; Permission controls are essential for access, but they do not perform calculations or process automation. A complete implementation should also check page assignment, field access, record ownership, and mobile behavior where those factors apply.
For record sharing, object permission must exist first, and then sharing can extend record visibility to users, public groups, roles, or roles and subordinates as appropriate.
---