Which policy types can only restrict permissions and never grant them?

Why this is the answer

All four set a maximum: the effective permissions are the intersection of the ceiling with an actual identity-based or resource-based grant. Treating organization policies as grants is the most common version of this mistake, and boundaries and session policies behave the same way — none of them can authorize a request on its own.