An operations group must inspect resources in one application compartment without changing them. What is the best policy scope?

1. No policy because the compartment is private.
2. Manage all resources in the tenancy.
3. Tenancy administrator membership for every operator.
4. The required inspect permissions in that compartment.