An application already has an IAM role but a request is blocked by a matching applicable deny policy. Adding another allow binding did not help. Which approach best fits?

1. Define and maintain a custom IAM role with the necessary supported permissions.
2. Apply the supported organization-policy restriction on service-account key creation.
3. Evaluate the deny policy and its exceptions rather than adding more allow grants.
4. Restrict federation using validated token attributes and narrowly scoped IAM bindings.