A service must temporarily use a KMS key for a supported job without repeatedly editing its key policy. Which KMS capability is designed for delegated permissions that can later be retired or revoked?

1. A narrowly scoped KMS grant.
2. An S3 lifecycle rule on the encrypted object.
3. A security group rule on the KMS key.
4. A public DNS record containing the key ARN.