Administrators need specific inbound messages held for review according to defined mail-policy conditions. Which approach best fits?

1. Configure supported Gmail POP and IMAP access restrictions.
2. Configure supported inbound-gateway and routing settings.
3. Configure an appropriate Gmail quarantine and matching compliance rule.
4. Evaluate Apps Script with scoped permissions and reviewed execution behavior.