What is the relationship between an IAM grant and a Security Zone policy?

1. A Security Zone automatically grants every user administrator access.
2. IAM grants authorize operations, while applicable zone policies can reject noncompliant operations.
3. IAM policies have no relevance once a zone exists.
4. Zone policies apply only to users whose names match the compartment.