The authority, exactly
The ordinary route, and the only one of the three where someone has to prove that hiring you is justified. Your employer is the applicant for the work authorisation, and it has to be applied for again for every new employment contract — a constraint the talent cards do not carry. It also brings an obligation the talent cards' own pages never mention: when the one-year card is first renewed into a multi-year one, a language and civics condition applies.