What two actions are required to achieve the above requirement?

An External Object is created to show Invoices from an external accounting system. When viewing the External Object, a user should only access invoice records the user is authorized to see.

What two actions are required to achieve the above requirement? Choose 2 answers
A . Setup External Object to use OAuth to connect to the Accounting system.
B. Create an owner based sharing rule to grant visibility to the Invoice object.
C. Restrict access to data in the accounting system.
D. Grant access to the External Object to only the Account Manager profile.

Answer: A,C