The correct answer is User role specifications.

User role specifications are explicit definitions that map specific users or groups to the features and privileges they may use in an application. These specifications are captured during requirements and design so that each role is clear about which features and actions are allowed and they directly inform access control implementation.

Identity and Access Management policy is a broader governance document about how identities are created managed and governed across systems. It does not typically enumerate feature level assignments of which users will use specific features in a single application.

Functional requirement statements describe what the system must do or the functions it must provide. While they may reference actors they are not the same as role specifications that explicitly assign features to named user roles.

Performance criteria focus on non functional measures such as speed throughput and responsiveness and they do not identify which users will use which features.

Full AWS Practitioner Certification Question