Which statement about Rule$-$Based Access Control is true?

a$.$ It dynamically assigns roles to subjects based on rules.

b$.$ It is no longer considered secure$.$

c$.$ It requires that a custodian set all rules.

d$.$ It is considered a real$-$world approach by linking a user's job function with security.