A business transfers an application to a cloud provider but retains residual risk beyond its stated tolerance. Who should make the authorized acceptance decision?

1. The application developer without delegated risk authority
2. The first employee who receives the migration notice
3. The designated business risk owner under the governance process
4. The provider's sales representative acting for the customer