Which of the following statements are true about Vault policies? (Choose two.)

The "default" policy, while automatically assigned to new tokens, can be modified by a root token or a token with sufficient privileges.

Vault policies are typically defined using HCL (HashiCorp Configuration Language), although JSON is also supported, not exclusively YAML.

Vault policies are written in HCL (Hashicorp Configuration Language) or JSON and declaratively specify which paths a client can access and what operations (read, create, update, delete, list, sudo) are allowed or forbidden on those paths.

Policy changes in Vault are dynamic; they take effect immediately upon being written or updated, without requiring a restart of the Vault server.

Vault's policy system operates on a "deny by default" principle. If a permission is not explicitly granted in a policy attached to a token, access to that path or operation is denied. An empty policy, therefore, grants no permissions.