Which design best preserves an account invariant that the balance never becomes negative?

Which design best preserves an account invariant that the balance never becomes negative?

1. Keep the balance private and expose validated deposit and withdrawal operations.
2. Keep the balance private but provide an unrestricted setter.
3. Make the balance public and document that callers should be careful.
4. Return a mutable balance holder so callers can update it efficiently.