A user successfully authenticates through a federated identity provider but cannot operate OCI resources. Which explanation is most likely?

1. Successful sign-in proves that all resource permissions exist
2. Federation automatically disables all IAM policies
3. Authentication trust is working, but the necessary group mapping or authorization policies are missing
4. Every federated user must receive a local administrator password