A service uses Vault Agent auto-auth with renewable credentials. What responsibility can the agent reduce for the application?

1. Managing supported Vault authentication and token renewal behavior
2. Making expired database credentials valid without contacting their issuer
3. Deciding the company's business risk acceptance policy
4. Granting permissions outside the configured policies