In Salesforce, what is a Restriction Rule?

A An org-wide policy that restricts API access to sensitive objects B An alternative to OWD that replaces all sharing rules C A rule that prevents specific users from creating records on certain objects D A security feature that filters which records a user can access within their existing visibility, effectively scoping down record access based on criteria