An ingestion service needs specific table writes and warehouse use. Which approach follows least privilege?

1. Share a human administrator's password
2. Use ACCOUNTADMIN for every scheduled job
3. Make all target tables publicly writable
4. Grant a dedicated role only the required object and compute privileges