A Hardware category requires a field in the browser form, and equivalent validation must cover non-browser updates. Which approaches are appropriate? Select 2 answers.

1. Assume a UI policy is sufficient protection for all API calls
2. Hide the field from the default form and consider validation complete
3. Add suitable server-side validation for other write paths
4. Use a UI policy for the conditional form behavior