A prototype uses broad sandbox permissions from a quickstart. What should happen before production rollout?

1. Replace them with policies scoped to required resources and operations
2. Remove all IAM policies and rely on prompt restrictions
3. Copy the broad policy unchanged because the example is official
4. Give every end user the API-key management permission