How granular may an administrator filter an Access Role with identity awareness?

How granular may an administrator filter an Access Role with identity awareness? Per:

A.
Specific ICA Certificate
B. AD User

C.
Radius Group

D.
Windows Domain