Where should a JWT verifier get its allowed algorithms?

Where should a JWT verifier get its allowed algorithms?

1. From server-side policy bound to the token kind and key
2. From the unverified alg header alone
3. From whichever algorithm makes verification succeed