How granular may an administrator filter an Access Role with identity awareness?

How granular may an administrator filter an Access Role with identity awareness?

A.
Windows Domain

B.
AD User

C.
Radius Group

D.
Specific ICA Certificate