A finance team wants one authoritative identity source for several SaaS products while each product retains its own permissions. Which design fits?

1. Federate authentication and manage application authorization separately
2. Replace all application permissions with network address filtering
3. Replicate one administrator password to every product
4. Assume successful federation grants every application role