A security design assumes that adding safety filters eliminates the need for IAM on agent tools. Which approach best fits?

1. Use appropriate gateway or policy controls and maintain explicit allowlists.
2. Minimize and protect telemetry, with redaction and approved retention.
3. Evaluate Model Armor policies alongside application controls.
4. Retain least-privilege tool authorization independently of content filtering.