A custom business role requires a stable set of supported permissions not covered narrowly by an existing predefined role. Which approach best fits?

1. Apply the supported organization-policy restriction on service-account key creation.
2. Evaluate the deny policy and its exceptions rather than adding more allow grants.
3. Define and maintain a custom IAM role with the necessary supported permissions.
4. Restrict federation using validated token attributes and narrowly scoped IAM bindings.