An emergency administrator needs elevated access only during an incident, with approval and auditability rather than a permanent broad grant. Which approach best fits?

1. Use a controlled time-bound privileged-access process.
2. Grant the required service-account attachment permission without broad token-creation privileges.
3. Use an IAM condition that limits the grant to the approved time window.
4. Analyze usage and IAM recommendations, then validate a staged permission reduction.