Junior analysts need case investigation access but must not modify organization-wide security integrations. Which approach best fits?

1. Configure supported workforce federation and explicit authorization.
2. Grant narrowly scoped security-platform roles matching their duties.
3. Use a dedicated least-privilege workload identity for the integration.
4. Review supported platform and Cloud Audit Logs administrative evidence.