A company wants reviewers to identify unused privileges before removing access from existing production workloads. Which approach best fits?

1. Use an IAM condition that limits the grant to the approved time window.
2. Analyze usage and IAM recommendations, then validate a staged permission reduction.
3. Use a controlled time-bound privileged-access process.
4. Grant the required service-account attachment permission without broad token-creation privileges.