An enterprise permits only a reviewed set of third-party actions. A repository administrator wants to permit a different unreviewed action locally. Which policy relationship applies?

1. Pinning any unapproved action to a tag automatically places it on the approved list.
2. Hide the unapproved action behind a reusable workflow and assume action policy no longer applies.
3. Set write-all on the job token to override the enterprise action allow list.
4. The repository cannot override a more restrictive inherited enterprise policy.