An application enables full model invocation logging for a regulated workload. Which two operational controls should accompany that choice? Select 2 answers.

1. Grant every tenant access to the shared log bucket.
2. Assume logs are harmless because they are operational metadata only.
3. Verify the logging scope and disclose or approve collection according to the organization requirements.
4. Retain all prompts forever without a documented purpose.
5. Restrict log access and configure suitable encryption and retention.