A payroll view is shared with analysts. They need its approved columns but must not access the raw payroll table. Which grant design best meets this requirement?

1. Transfer ownership of the raw table to the analyst group
2. Grant SELECT on the raw table and hide it from the dashboard
3. Grant required catalog/schema usage and SELECT on the governed view, without granting analysts SELECT on the raw table
4. Grant BROWSE on the raw table instead of SELECT on the view