A contractor's engagement ends today. Which action best closes their identity lifecycle?

1. Disable access promptly and revoke relevant credentials
2. Rename the account but keep active sessions
3. Transfer the account to the next contractor
4. Wait for the account's next annual review