A company wants reviewers to identify unused privileges before removing access from existing production workloads. Which approach best fits?

1. Grant the required service-account attachment permission without broad token-creation privileges.
2. Use an IAM condition that limits the grant to the approved time window.
3. Use a controlled time-bound privileged-access process.
4. Analyze usage and IAM recommendations, then validate a staged permission reduction.