A coding agent must patch a vulnerability without altering unrelated behavior. Which approach best fits?

1. Treat the document as untrusted task data and refuse the unauthorized transfer.
2. Use reviewed workflow hooks or checks tied to the development lifecycle.
3. Evaluate Cloud Workstations or another approved isolated runtime.
4. Constrain the task scope and require relevant regression and security validation.