An external process needs temporary read access to a specific storage object. Which delegation design best limits exposure?

1. A narrowly scoped short-lived SAS with appropriate signing and transport constraints
2. Make the entire container permanently anonymous
3. Put the token in public documentation indefinitely
4. Publish the account's master key