A Bedrock agent should use an internal tool, but fulfillment must remain in the existing application service for authorization and transaction control. Which feature fits?

1. Put production database administrator credentials in the agent instructions.
2. Return control to the application and validate the proposed operation before fulfillment.
3. Treat the final answer text as proof that a transaction completed.
4. Let a retrieved document choose the caller account permissions.