A security team wants to apply least privilege to a cross-cloud application. Which approach best matches that goal?

1. Permit each model-generated request to choose an arbitrary administrator identity
2. Grant all available roles because the application crosses providers
3. Grant only the actions and resource scopes required by each application component
4. Treat a service's display name as a permission boundary