A platform team wants consistent foundations while allowing workload-specific extensions. Which approach fits OCI landing zones?

1. Use versioned baseline modules plus reviewed extension modules and explicit permissions.
2. Copy every deployment manually and stop tracking the original definitions.
3. Place application source code inside IAM policy statements.
4. Permit extensions to remove central logging without review.