A user needs temporary access to a specific object without receiving an OCI API signing key. Which capability may fit if carefully scoped and governed?

1. Putting the user's password into the object name.
2. A time-limited pre-authenticated request for the intended operation and object scope.
3. Sharing the administrator's private signing key.
4. A public bucket containing every private object.