An agent can read billing data but must never modify payment settings. Which approach best fits?

1. Validate the identifier and enforce tenant authorization in trusted code.
2. Grant a narrowly scoped read identity and withhold mutation capabilities.
3. Enforce a concrete approval gate before executing the action.
4. Keep source text untrusted and enforce tool and egress authorization outside the model.