A company is onboarding six business units into OCI. Each unit must operate its applications while a central team controls networking and security. Which foundation best supports this requirement?

1. One compartment with tenancy-wide administrator rights for every unit.
2. Tags alone, with a shared administrator account.
3. A landing zone with separate workload and shared-service compartments and scoped IAM policies.
4. Separate subnets with no changes to tenancy-wide IAM grants.