A project already inherits a broad role from its parent folder. An administrator removes the same role from the project's local allow policy, but access remains. Which approach best fits?

1. Grant the narrowest suitable role on the required dataset.
2. Grant IAM roles to a managed group and maintain group membership.
3. Place production projects in a folder and grant the appropriate role at that folder.
4. Inspect and change the inherited grant at its source if it should no longer apply.