A generated refactor adds a new webhook that can schedule refunds. What is the strongest …

A generated refactor adds a new webhook that can schedule refunds. What is the strongest first security review step?

1. Model the new actors, entry point, identity, protected assets, privileged effect, and abuse cases before tracing controls
2. Approve it because the generated function is short and uses async/await
3. Run only the existing successful refund test
4. Ask the model whether the code follows security best practices