A recurring production job currently runs under a departing employee's identity. What is the best correction?

1. Use an anonymous account
2. Share one personal administrator password with all engineers
3. Keep using the former employee's credentials indefinitely
4. Use an appropriately scoped service principal run-as identity