A data pipeline accesses files in Object Storage before loading them into a database. Which practice is appropriate for the required credentials or resource authorization?

1. Assume every stored file should be executable database code
2. Embed a shared tenancy administrator's key in every dataset row
3. Make every source bucket public to avoid access configuration
4. Use an approved, scoped access mechanism and protect sensitive credentials