An automation runbook must perform recurring management tasks without embedding a user's password. Which design is preferred?

1. Use a supported workload identity with least-privilege access and auditable execution
2. Put an administrator password directly in the published script
3. Disable service authorization for the task
4. Run every job as an unrestricted global administrator