A potentially compromised domain controller supports critical business operations. Who should determine a high-impact containment action?

1. The authorized incident leadership with relevant operational owners
2. Any unrelated external caller who requests shutdown
3. Only the first employee who notices an alert
4. An automated report title without human review where policy requires approval