Which statement best describes the default AuthZ behavior for users and groups in Oracle Cloud Infrastructure IAM?

Oracle Cloud Infrastructure IAM operates on a "deny by default" security principle, which is a cornerstone of the principle of least privilege. This means that by default, no user or group has any permission to access or manage any resource in the tenancy. Permissions must be explicitly granted through IAM policies written by an administrator. If no policy grants access for a specific action on a resource, the request is automatically denied. This ensures that access is intentional and controlled.

A. Granting access to all resources by default would be a major security vulnerability and is the opposite of OCI's security model.
B. While users may request access, the underlying authorization model is based on policies, not a request workflow.
C. Access is never granted based on roles (groups) alone; a policy must always explicitly grant permissions to that group.

1. Oracle Cloud Infrastructure Documentation, "How Policies Work", Section: "The Basics". States: "If no policy grants access, then the request is denied... This is a "deny by default" model."

2. Oracle Cloud Infrastructure Documentation, "Introduction to Policies". States: "By default, users can't access any of the Oracle Cloud Infrastructure resources. An administrator must write policies to grant users access to the relevant resources."