A user belongs to several groups with different policies. How should access be evaluated?

1. Assume a narrow grant automatically cancels every broader grant.
2. Consider all applicable grants and policy conditions for the requested operation.
3. Ignore tenancy policies when a resource has tags.
4. Use only the alphabetically first group.