The additional policy. When you attach an instance RAM role to instances, you can specify an additional policy to further limit the permissions of the role.