A support account only needs read-only device diagnostics. Which permission approach is appropriate?

1. Permission to erase configurations only
2. Full administrative access indefinitely
3. Least-privilege diagnostic access
4. One shared anonymous root account