Infrastructure administrators and ordinary desktop users require different privileges. Which design best reduces unnecessary authority?

1. Assume private IP addresses eliminate the need for user authorization
2. Separate management roles from user resource access and use least privilege
3. Make every user Owner of all host pools
4. Use one shared administrator identity for all sessions