Which authorization object is required to modify authorization data of derived roles?

Which authorization object is required to modify authorization data of derived roles?

A. S_USER_SYS

B. S_USER_AUT

C. S_USER_VAL

D. S_USER_AGR