A company wants common IAM grants for every production project while keeping development grants separate. Projects already belong to one organization. Which approach best fits?

1. Inspect and change the inherited grant at its source if it should no longer apply.
2. Grant the narrowest suitable role on the required dataset.
3. Grant IAM roles to a managed group and maintain group membership.
4. Place production projects in a folder and grant the appropriate role at that folder.