Which of the following statements are true about declarative security? Each correct answer represents a complete solution. Choose all that apply.  

It is employed in a layer that relies outside of the software code or uses attributes of the code. 

It applies the security policies on the software applications at their runtime. 

In this security, authentication decisions are made based on the business logic 

In this security, the security decisions are based on explicit statements.