A deployment pipeline can modify every resource in the tenancy although it deploys one service. What is the best correction?

1. Disable Audit for deployment operations.
2. Give the same privileges to all repository readers.
3. Keep unrestricted rights because automation is inherently trusted.
4. Scope its identity and policies to the required resource types and deployment compartments.