A deployed agent must be distinguishable from other workloads when it calls Google Cloud resources. Which approach best fits?

1. Use a suitable agent registry and maintained ownership metadata.
2. Assign an appropriate agent or workload identity with least-privilege grants.
3. Evaluate Agent2Agent for the supported interaction.
4. Use an MCP integration with validated tool definitions.