A developer is allowed to create roles but must not grant those roles more permission than an approved maximum. Which design most directly enforces that limit?

1. Use a permissions boundary as the sole grant of every allowed action.
2. Put the approved actions in a public README without enforcing them.
3. Require an approved permissions boundary on created roles and restrict changes to that boundary.
4. Attach an administrator policy and rely only on a naming convention.