A company has hundreds of analysts with identical access requirements. Joiners and leavers must be managed without editing every project policy individually. Which approach best fits?

1. Grant the narrowest suitable role on the required dataset.
2. Place production projects in a folder and grant the appropriate role at that folder.
3. Inspect and change the inherited grant at its source if it should no longer apply.
4. Grant IAM roles to a managed group and maintain group membership.