A custom business role requires a stable set of supported permissions not covered narrowly by an existing predefined role. Which approach best fits?

1. Restrict federation using validated token attributes and narrowly scoped IAM bindings.
2. Define and maintain a custom IAM role with the necessary supported permissions.
3. Evaluate the deny policy and its exceptions rather than adding more allow grants.
4. Apply the supported organization-policy restriction on service-account key creation.