A task needs one networked package download. Which approval is safest?

A task needs one networked package download. Which approval is safest?

1. Approve that exact command, registry destination, working directory, and one invocation
2. Approve every future shell command because this task is trusted
3. Allow unrestricted network access but keep file writes disabled
4. Put a sentence in the prompt asking the model to be careful