An application needs to invoke one approved Bedrock model but does not need to manage IAM users or change account infrastructure. Which access approach best follows least privilege?

1. Attach AdministratorAccess because any application using AI requires full account control.
2. Use an application role granting only the required supported inference actions and resource access.
3. Rely only on a prompt telling the model not to call unauthorized APIs.
4. Put a root access key in the application source so it never encounters a permission failure.