Build, test, and deployment stages share one administrator role. The organization wants separation of duties and limited impact from a compromised build. Which change best fits?

1. Keep one broad role and use different display labels for each stage.
2. Use separate narrowly scoped stage identities, with controlled production deployment and approval permissions.
3. Publish the role credentials so every stage can troubleshoot quickly.
4. Disable all stage audit logs to conceal permission use.