A new automation rule will block accounts based on a detection. How should it be introduced for a sensitive production environment?

1. Enable global execution before testing
2. Omit execution logs to reduce alert volume
3. Give its identity permanent unrestricted privileges
4. Validate detection precision, restrict execution scope, and add approval where required