An external workload federation trust accepts tokens from an entire identity-provider tenant, but only one repository should deploy production workloads. Which approach best fits?

1. Define and maintain a custom IAM role with the necessary supported permissions.
2. Apply the supported organization-policy restriction on service-account key creation.
3. Evaluate the deny policy and its exceptions rather than adding more allow grants.
4. Restrict federation using validated token attributes and narrowly scoped IAM bindings.