A company uses a managed database. The provider patches the engine, but the customer controls users and table grants. What should the assessment distinguish?

1. A requirement that the customer patch provider-owned hardware
2. Provider-managed platform controls from customer-managed access controls
3. The assumption that managed means no customer responsibility
4. The idea that the provider can never supply assurance