A sensitive tool action needs explicit user approval after the proposed operation is fully described. Which approach best fits?

1. Enforce a concrete approval gate before executing the action.
2. Keep source text untrusted and enforce tool and egress authorization outside the model.
3. Grant a narrowly scoped read identity and withhold mutation capabilities.
4. Validate the identifier and enforce tenant authorization in trusted code.