A merger introduces incompatible access practices across two companies. What should guide the integration plan?

1. Retention of every legacy permission indefinitely
2. Whichever company owns the newer identity platform
3. Immediate unrestricted federation between both directories
4. A joint risk assessment and target control requirements