Security proposes an OCI deny policy covering the whole multicloud compartment. What should happen first?

1. Replace all database backups with the deny policy.
2. Delete every Azure role assignment as a prerequisite.
3. Exclude the protected MulticloudLink resources from deny-policy scope as documented.
4. Apply it immediately because Azure RBAC always overrides OCI denial.