An analyst needs read-only access to one dataset. The administrator must avoid granting unrelated project administration permissions. Which approach best fits?

1. Place production projects in a folder and grant the appropriate role at that folder.
2. Grant IAM roles to a managed group and maintain group membership.
3. Inspect and change the inherited grant at its source if it should no longer apply.
4. Grant the narrowest suitable role on the required dataset.