An external workload federation trust accepts tokens from an entire identity-provider tenant, but only one repository should deploy production workloads. Which approach best fits?

1. Restrict federation using validated token attributes and narrowly scoped IAM bindings.
2. Evaluate the deny policy and its exceptions rather than adding more allow grants.
3. Define and maintain a custom IAM role with the necessary supported permissions.
4. Apply the supported organization-policy restriction on service-account key creation.