An automated scan fails to identify an authorization flaw that allows one user to view another user's invoice. What testing approach addresses this gap?

1. Only increasing the number of scanned UDP ports
2. Only checking certificate expiration
3. Only changing the browser's visual theme
4. Manual role and object-level access-control testing with approved accounts