A support group must view resource details but must not modify resources. Which IAM practice best matches this requirement?

1. Grant the narrow read permissions needed in the relevant compartment
2. Share one administrator account and rely on written instructions
3. Grant tenancy-wide manage permissions for convenience
4. Add every support user to the administrators group