A secondary subscription is linked, and its administrators need restricted Oracle-side resource control. What should be used?

1. OCI policies scoped to its mapped subcompartment and appropriate resources.
2. An Azure tag whose text says OCI administrator.
3. A shared connection string containing the OCI root password.
4. A tenancy-wide manage-all policy for every application user.