Option B is correct because the Step Functions callback pattern with a task token is designed for long-running external approval or control-plane workflows. Step Functions can pause the state machine without consuming Lambda or container compute, preserve execution state, and resume only when the generated task token is returned through SendTaskSuccess or SendTaskFailure. The token acts as a unique correlation and authorization mechanism for the pending task, which is better than polling, holding a worker open, or periodically reinvoking the workflow. AWS documentation states that callback tasks pause execution until the task token is returned and explicitly identifies human approval and third-party integrations as valid use cases. This meets the requirements for asynchronous external approval, no long-lived credentials, and no unnecessary compute consumption.