A migration uses a temporary privileged source account. What should its lifecycle include?

1. Minimum necessary access, protected storage, auditability, and prompt retirement after validated completion.
2. Permanent administrator access without an owner.
3. Public storage so every tool can find the password.
4. Deleting audit logs before account removal.