An analyst needs read-only access to one dataset. The administrator must avoid granting unrelated project administration permissions. Which approach best fits?

1. Place production projects in a folder and grant the appropriate role at that folder.
2. Grant the narrowest suitable role on the required dataset.
3. Grant IAM roles to a managed group and maintain group membership.
4. Inspect and change the inherited grant at its source if it should no longer apply.