A financial services company is architecting a highly available application on OCI. The application tier runs on a set of compute instances within a private subnet and must communicate with an Autonomous Transaction Processing (ATP) database. To ensure secure and private communication, the network architect has decided to use a Service Gateway. Which of the following IAM policies is required to allow instances in the VCN to make calls to the Oracle Services Network?