A production application calls an OCI AI service. Which authentication and authorization practice is appropriate?

1. Embed a shared tenancy-administrator private key in every client application
2. Publish the service credential in a public repository for easier deployment
3. Grant a suitable application principal only the service access it needs
4. Remove all IAM checks because the model endpoint is managed