A tool receives a customer identifier from model output and accesses a tenant database. Which approach best fits?

1. Keep source text untrusted and enforce tool and egress authorization outside the model.
2. Grant a narrowly scoped read identity and withhold mutation capabilities.
3. Validate the identifier and enforce tenant authorization in trusted code.
4. Enforce a concrete approval gate before executing the action.