A role identity policy allows an action, but an applicable service control policy explicitly denies it. No other grant changes the evaluation. What is the outcome?

1. The role allow always overrides the organization deny.
2. The request is allowed whenever the caller uses a private endpoint.
3. The request succeeds if the role session name contains administrator.
4. The request is denied because the applicable explicit deny takes precedence.