A team uses a managed foundation-model service and assumes that AWS therefore decides which employees may retrieve the company confidential documents. Which statement correctly reflects the shared responsibility model?

1. The customer must physically secure AWS data centers to enforce document access.
2. Using a managed service transfers all document classification and employee authorization decisions to AWS.
3. AWS manages the relevant service infrastructure, while the customer remains responsible for its data use, permissions, and application access controls.
4. All employees automatically gain access to every document once a model endpoint is available.