A partner needs governed read access to selected datasets without receiving the provider's cloud storage keys. Which mechanism fits?

1. A public copy of the provider's storage credential
2. A wildcard MANAGE grant on the metastore
3. An unencrypted download of the full raw lake
4. Delta Sharing