A company needs an organization-wide maximum permission boundary that prevents member accounts from disabling required security services. Which mechanism should it evaluate?

1. Service control policies scoped to the relevant organizational units and actions.
2. Only a management-account security group.
3. Only an account display-name convention.
4. An SCP that grants administrator permissions to every member role.