A user can manage compute in an application compartment but cannot launch into a shared-network subnet. What should be checked?

1. Whether the user can download every object in the tenancy.
2. Whether the compute instance's name contains the subnet name.
3. Whether the application has a higher budget.
4. The separate permissions required to use the shared network resources.