An audit policy records RequestResponse bodies for all Secret requests. Security analysts notice credential values in the audit backend. Which policy change reduces unnecessary sensitive payload collection while retaining request identity metadata?

1. Grant public access to the audit backend
2. Use an appropriate Metadata audit level for Secret requests
3. Base64-encode the entire audit log and keep collecting bodies
4. Delete the Secret resource type from the API server