A company uses AWS Organizations and wants central permission guardrails across member accounts. Which TWO statements about service control policies are correct? Select TWO.

1. Attaching an SCP converts all member accounts into one shared root user.
2. Allowing an action in an SCP automatically grants it to every IAM user.
3. SCPs can limit the permissions available in affected member accounts.
4. SCPs store application passwords and rotate them automatically.
5. An SCP does not grant an identity permission to perform an action by itself.