A compliance team asks who is responsible for limiting application access to business data in an autonomous service. What is the best answer?

1. No one, because backups are managed
2. Oracle automatically knows each employee's business entitlement
3. The customer still configures application identities and data privileges
4. Any user with a database URL may decide their own privileges