A user-facing API must validate the caller's identity and check resource-specific access before returning tenant data. Which approach best fits?

1. Validate authentication tokens and enforce authorization in the service.
2. Use the attached service account with application default credentials.
3. Persist an idempotency record tied to the webhook's stable business identifier.
4. Honor retry guidance with bounded backoff and a defined failure path.