An IAM identity policy allows an operation, but an applicable resource policy explicitly denies the same request. What is the expected authorization result?

1. The newest policy always wins regardless of allow or deny.
2. The explicit deny prevents the operation despite the allow.
3. The longest policy document overrides shorter policies.
4. Renaming the role removes the resource policy deny automatically.