A compartment must reject creation of public buckets under its security recipe. Which capability provides operation-time enforcement?

1. Security Zones with the relevant policy enabled.
2. A Cloud Guard dashboard assumed to deny every request synchronously.
3. A public bucket naming convention.
4. A budget warning email.