A platform team shares centrally owned VPC subnets with application accounts. What remains important to preserve responsibility boundaries?

1. Use subnet names as the sole IAM boundary.
2. Give every participant unrestricted control of all network-owner resources.
3. Assume sharing transfers ownership of every participant resource to the network account.
4. Define owner and participant permissions explicitly and apply workload resource controls in participant accounts.