A reporting identity should select from specified tables and must not update data or administer the database. Which approach best fits least privilege?

1. Make the identity db_owner
2. Rely only on hiding edit controls in the report UI
3. Grant the necessary SELECT permissions through a narrowly scoped role
4. Grant every server administrator permission