What can be a subject of the IBM Cloud Identity and Access Management policy?

What can be a subject of the IBM Cloud Identity and Access Management policy?

A. Resource Group
B. Service
C. Service Roles

D. Service ID

Reference: https://cloud.ibm.com/docs/account?topic=account-iamoverview