Oracle ' s documented API Gateway-to-Functions integration uses a dynamic group representing the API Gateway and an IAM policy granting that dynamic group use functions-family in the compartment containing the target Function. The use verb provides the operational permission necessary for invocation without granting unnecessary administrative control. manage functions-family would be excessively privileged because it includes lifecycle management capabilities. The read and inspect verbs are insufficient for executing a Function and, in options C and D, are also scoped to the wrong compartment. Because the authorizer resides in secure-auth-compartment, authorization must apply there. Consequently, A implements the Oracle-documented pattern and satisfies least privilege for API Gateway invocation of the custom authorizer Function.