What architecture should be recommended in order to maintain the Salesforce security model already in place?

A web application on Heroku wants to surface Salesforce data. All users of the web application will:

1) Authenticate using SSO with Salesforce.

2) Have user records in Salesforce.

What architecture should be recommended in order to maintain the Salesforce security model already in place?
A . Use Heroku Connect to sync the Salesforce data and Salesforce security model to Heroku Postgres.
B . Have the application query Salesforce data and the security model directly using a cached admin credential.
C . Use Heroku Connect, with a per-user authentication model, to sync the Salesforce data to Heroku Postgres.
D . Have the application query Salesforce data directly through the Salesforce APIs as the running user.

Answer: D

Explanation:

https://devcenter.heroku.com/articles/addon-controls