A support application needs read-only access to database items. Which authorization principle should guide its role assignment?

1. Grant only the required data actions at the narrowest suitable scope
2. Use account-wide write privileges solely for convenience
3. Grant tenant Global Administrator to every application instance
4. Depend on a UI hiding the delete button as the only protection