A platform uses a private subnet and assumes its database is protected from all unauthorized access. What is missing from this reasoning?

1. IAM, database identities, network controls, encryption, and monitoring still need explicit design.
2. Every workload in a private subnet shares one safe administrator identity.
3. Private addressing automatically grants least privilege to all database users.
4. A private subnet makes all application inputs trustworthy.