Backup operators should not be able to silently destroy all recovery history after their credentials are compromised. Which design should be evaluated?

1. Give one shared account unrestricted purge rights
2. Treat replication as a guarantee deleted backups reappear
3. Keep only one unprotected copy on the production server
4. Supported soft-delete, immutability, separation of duties, and enhanced backup authorization controls