A pipeline upgrades its Terraform provider and proposes unexpected resource replacement. What should happen before approval?

1. Review provider constraints, lock-file changes, and replacement causes in the plan.
2. Remove the plan output from the job history.
3. Grant more IAM permissions until the replacement disappears.
4. Apply immediately because provider updates cannot affect resources.