A company wants reviewers to identify unused privileges before removing access from existing production workloads. Which approach best fits?

1. Use a controlled time-bound privileged-access process.
2. Analyze usage and IAM recommendations, then validate a staged permission reduction.
3. Grant the required service-account attachment permission without broad token-creation privileges.
4. Use an IAM condition that limits the grant to the approved time window.