An enterprise application requests broad organizational API permissions. What should be evaluated before granting consent?

1. The business need, publisher, requested permissions, and tenant impact
2. Only the application's icon
3. Only whether the app's name includes secure
4. Grant every permission to avoid future support requests