An operator should manage accounts in one OU without receiving domain-wide administrator rights. What is the best approach?

1. Delegate only the required directory permissions on the intended OU
2. Share a built-in administrator account
3. Add the operator to Domain Admins permanently
4. Grant write access to every directory object