Explanation

Box 1: "Microsoft.Resources/subscriptions/resourceGroups
To create a new resource group in a subscription, account have at least the this permission.
Box 2: "Append"
Append adds fields to the resource when the if condition of the policy rule is met. If the append effect would override a value in the original request with a different value, then it acts as a deny effect and rejects the request. To append a new value to an existing array, use the [*] version of the alias Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure
https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles
https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects