A tester suspects an authentication rate-limit gap. The engagement authorizes a small, fixed number of attempts against designated test accounts. What is the appropriate validation?

1. Stay within the agreed attempt limit and document observed enforcement
2. Continue attempts against real employees until accounts lock
3. Distribute attempts across unrelated organizations
4. Disable the client's login monitoring first without approval