A small project team needs an additional object permission without changing access for everyone using its existing profile. What should the administrator evaluate?

1. A permission set assigned only to the project users
2. A new role used as an object-permission container
3. A common password shared by the project users
4. A broader organization-wide record default as the sole change