A release service account must read Deployments only in namespace staging. Which authorization setup grants the required access without granting it in other namespaces?

1. A ServiceAccount object without any role binding
2. A Role allowing get/list/watch on deployments and a RoleBinding in staging
3. A Role allowing all verbs on secrets in staging
4. A ClusterRoleBinding to the built-in edit role