A background daemon must call an API without any signed-in user. Which permission model should be considered where the API supports it?

1. Delegated-only permissions with an imaginary user session
2. The last human user's browser cookie stored indefinitely
3. Anonymous write access to the API
4. Application permissions with appropriate administrative consent and least privilege