A member-account deployment role has an IAM allow, but an applicable SCP explicitly denies the requested action. Which result should the pipeline handle?

1. The explicit deny blocks the operation; the approved guardrail or deployment design must be addressed legitimately.
2. AdministratorAccess attached to the role always overrides every SCP deny.
3. SCPs grant permissions automatically even without any role policy.
4. The pipeline succeeds if it changes the commit message to approved.