An administrator needs to stop a record save when a discount exceeds the allowed threshold without an approved exception. Which control is most direct?

1. A validation rule expressing the prohibited condition and exception logic
2. An organization-wide sharing default
3. A dashboard that displays the discount after the save
4. A field label describing the desired threshold only