An automated responder receives the same finding twice. The first run isolated a resource; the second tries to apply the same change and fails. Which design improvement is best?

1. Generate a random resource ID each time before containment.
2. Give the responder unrestricted administrator permissions for every account.
3. Make containment idempotent, track execution state, and handle already-contained resources safely.
4. Disable all retries and assume each finding is delivered exactly once.