A content owner wants to confirm that a regional viewer cannot access other regions after a model update. What is the best verification?

1. Inspect the report theme JSON
2. Test only as workspace Admin
3. Hide the Region column from the field list
4. Test the relevant RLS role and a representative viewer identity