An operations group needs to list Object Storage resources and read their metadata, but it must not download object contents or change resources. Which policy design best follows least privilege?

1. Grant manage permissions for all resources in the tenancy
2. Add the group to the tenancy administrators group
3. Grant only the applicable inspect permissions in the required compartment
4. Grant object write permissions because metadata is part of an object