A team gives a CI pipeline permission to manage all resources in the tenancy for a single application deployment. What should the architect recommend?

1. Keep the permission because automation cannot make mistakes.
2. Share the same pipeline credentials with all application users.
3. Remove deployment logs to avoid revealing privileged operations.
4. Scope the pipeline identity to the resource types and compartments required by its deployment.