Universal Containers implements a private sharing model for Convention_Attendee__c.

In a private sharing model, access is restricted to the owner and those above them in the hierarchy. When a specific user is identified in a lookup field (like Event_Reviewer__c), standard sharing rules cannot dynamically grant access to that specific individual because sharing rules only target Roles, Public Groups, or Territories.1

The solution is Apex Managed Sharing (Option A). By using an after insert (and likely after update) trigger, the developer can pro2grammatically create records in the object's "Share" table (e.g., Convention_Attendee__Share). Each share record specifies the UserOrGroupId (from the lookup field), the AccessLevel ('Edit' for Read/Write), and a RowCause (Apex Sharing Reason).

The "After" trigger is required because the ID of the Convention_Attendee__c record must exist before a Share record can be associated with it. "Before" triggers (Option B) are used for field updates on the record itself, not for creating related sharing records. Options C and D are not viable because they cannot dynamically reference a User ID stored within a field on the record itself. Apex Managed Sharing provides the most granular and automated way to handle this dynamic security requirement.