Under a shared-responsibility model, which duty remains with the customer organization?

1. Personally maintain the provider's physical data-center power
2. Assume the provider approves every custom role assignment
3. Treat all customizations as automatically secure
4. Manage appropriate user access and instance configuration