A response workflow would quarantine every instance sharing a common tag. A new finding affects one critical production system. What is the best safeguard before broad automatic containment?

1. Validate resource scope, use least-privilege actions, and require approval for high-impact containment.
2. Assume tags can never be missing or incorrect.
3. Remove all response logging to make the workflow faster.
4. Use administrator privileges and skip all resource checks.