A landing zone has central network administrators and application-specific operators. Which authorization design is appropriate?

1. A private subnet assumed to grant every required management permission.
2. Scoped compartment policies with explicit permissions for required shared-service use.
3. One shared account without individual attribution.
4. Permanent unrestricted tenancy administration for all application teams.