How can you restrict access to a custom API resource?

A.
Only by creating a new role under System/Web Services/Roles

B.
By setting up an ACL in etc/api.xml and creating a new role for it in System/Web Services/Roles

C.
Only by extending Mage_Api_Controller_Action and overriding the _isAllowed method

D.
By setting up an ACL in etc/adminhtml.xml and creating a new role in System/Permissions/Roles