Which statement about service control policies $($SCPs$)$ is true?

SCPs cannot restrict access to member accounts.

SCPs can restrict access to services, resources, or API actions.

Restrictions from an SCP will be overridden if allowed elsewhere.

SCPs can be used to grant permissions.