A company shares a Transit Gateway with accounts through AWS RAM. What security responsibility remains with the network owner?

1. Govern attachment acceptance, route associations, and propagation to preserve the intended segmentation.
2. Assume RAM sharing automatically prevents every spoke-to-spoke route.
3. Give every member account permission to change all central security policies.
4. Remove route table review because all shared attachments are trusted forever.