A production workspace should plan on version-control changes but require approval before apply. What should be configured?

1. A VCS-connected workflow with controlled apply permissions
2. Automatic apply permissions for anonymous users
3. A shared untracked local state file
4. Disabling all plan output