A security tool flags a script run by a deployment agent. What distinguishes useful validation from a filename-only decision?

1. Allow any script named deploy
2. Compare execution context, signed or approved artifact identity, and change records
3. Assume the deployment account cannot be compromised
4. Block every script extension permanently without assessing business use