Which is true when assigning global permissions in a single vSphere Single Sign-On domain in a multi-site configuration?

While global permissions do span all vCenter instances within the SSO domain, implying unrestricted cross-domain access is incorrect because permissions are bounded by the SSO domain boundary.

Global permissions are not limited to a single site - they apply to all vCenter Server instances that are members of the same SSO domain.

A global permission grants whatever role is assigned, not automatically administrator access - the privilege level is determined by the specific role bound to that permission.

Global permissions in vSphere are scoped to a specific vSphere Single Sign-On domain. In a multi-site configuration sharing a single SSO domain, those permissions propagate to all vCenter Server instances joined to that domain, but they are strictly confined within that domain's boundary and do not cross into a separate SSO domain.