An emergency administrator needs elevated access only during an incident, with approval and auditability rather than a permanent broad grant. Which approach best fits?

1. Analyze usage and IAM recommendations, then validate a staged permission reduction.
2. Use an IAM condition that limits the grant to the approved time window.
3. Grant the required service-account attachment permission without broad token-creation privileges.
4. Use a controlled time-bound privileged-access process.