An organization moves to infrastructure as code. What risk-control opportunity is most relevant?

1. Assuming every deployment is identical without validation
2. Versioned, reviewed, and repeatably validated infrastructure configuration
3. Giving every developer unrestricted production credentials
4. Eliminating all change review because code is used