A CI job must update only the Sunbird resources in a dedicated development compartment. What IAM approach fits?

1. Grant manage all-resources in the tenancy for convenience
2. Disable all IAM checks during every deployment
3. Grant the automation identity only the required scoped resource permissions
4. Use a learner's application password as the OCI API credential