A developer needs temporary access as a service account for debugging. Administrators want auditable delegation without sharing a private key. Which approach best fits?

1. Use Workload Identity Federation with appropriately scoped trust and IAM grants.
2. Use Workload Identity Federation for GKE with per-workload grants.
3. Grant narrowly scoped service-account impersonation permissions and use short-lived credentials.
4. Attach a least-privilege service account and use application default credentials.