A CI workload runs outside Google Cloud and can present a trusted repository identity token. It must deploy only one approved project without storing long-lived Google credentials. Which two design choices meet these requirements? Select 2 answers.

1. Restrict trusted token attributes and grant only the required deployment permissions.
2. Grant project Owner to every identity from the external provider.
3. Use workforce federation as a replacement for the software workload identity.
4. Use Workload Identity Federation for short-lived access.
5. Store a service-account private key in the repository secret store as the primary identity path.