An assessment permits pivoting only through one designated test host into one specified subnet. What should the tester enforce?

1. Keep the pivot running after the engagement ends
2. Treat all reachable partner networks as included
3. Restrict the pivot's destinations and activity to the approved boundary
4. Route traffic to every newly discovered subnet