At Universal Containers, a user's department determines which fields the user can see and edit on Opportunities. For example, users on the Sales team can edit all fields on the Opportunity, while users on the Support team have read-only access to these fields. In which location is field-level security controlled for users on these teams?