A service account has not been used for months but retains broad privileges. What is the appropriate review action?

1. Retain all privileges forever because the account might be useful.
2. Publish its key so future teams can discover it.
3. Rename the account to inactive without changing permissions.
4. Verify its purpose and dependencies, then remove unnecessary access and retire unused credentials safely.