Analysts query a Lake Formation-governed table through a supported integrated engine. They may see only approved columns and rows for their business unit. The team wants governed access rather than publishing an unrestricted duplicate. Which feature should it evaluate?

1. Give analysts unrestricted direct S3 access and rely exclusively on the filtered SQL interface to prevent every alternate read.
2. Lake Formation fine-grained permissions and supported data filters, with appropriate IAM and engine integration configuration.
3. Change only the crawler schedule while leaving analyst authorization unchanged.
4. Create a normal view hiding fields while retaining unrestricted SELECT privileges on the base table.