A remediation runbook starts successfully but fails when it attempts a required resource update. Logs show AccessDenied. Which first investigation fits?

1. Disable every log and declare the execution healthy.
2. Change only the runbook display title.
3. Grant all engineers root credentials as the only possible fix.
4. Inspect the Automation execution-role permissions, trust, and actual resource scope for the failing step.