A migration target must use stricter data access permissions than the legacy source while retaining necessary application access. Which approach best fits?

1. Rebuild least-privilege target permissions and validate workload identities.
2. Run a representative rehearsal against an isolated target and document measured results.
3. Use appropriately de-identified representative test data.
4. Complete operational handover and validate target backups, alerts, and runbooks.