In what places can an access role be used?

A.
In the Application & URL Filtering rule base

B.
In the security rule base and DLP policy

C.
In the security rule base and in the Application & URL Filtering rule base

D.
Access roles can only replace the legacy authentication methods