A CI identity deploys one application in namespace build. It currently has cluster-admin. What is the best authorization change after identifying the operations it actually needs?

1. Keep cluster-admin but rename the service account limited-ci
2. Share a root administrator's kubeconfig instead
3. Add an unrelated deny Role alongside cluster-admin
4. Replace cluster-admin with narrowly scoped permissions and a namespace-level binding