Which of the following are correct, regarding RAM users?

RAM users can be created under a single Alibaba Cloud account, corresponding to employees, systems, or applications.

RAM users do not "own" the resources that they create (those belong to the Alibaba Cloud account itself), and RAM users cannot generate and pay their own individual bills (costs accrue to and are billed to the master Alibaba Cloud account).

RAM users belong to an Alibaba Cloud account, but they can also operate as independent accounts with their own private resources, not visible to the primary Alibaba Cloud account.

RAM users must be authorized by the Alibaba Cloud account to log in to the console or use the API to manage the resources owned by the Alibaba Cloud account.