A company introduces an external MCP server that can access internal resources. Which approach best fits?

1. Maintain a controlled inventory and a reviewed promotion process.
2. Review server trust, authentication, requested permissions, and network exposure.
3. Use distinct appropriate identities and scoped auditability.
4. Implement governed retention and deletion across memory and derived artifacts.