Two teams need separate roles for key administration and application data access. What should be designed?

1. A rule that possessing a private IP grants key administration.
2. Public key deletion access with private object reads.
3. Distinct IAM permissions for key lifecycle operations, key use, and data access.
4. One shared administrator credential for all tasks.