A team places a customer email address in a KMS encryption context and assumes the context is secret. What should the security engineer explain?

1. KMS always encrypts and hides the context from CloudTrail.
2. Encryption context replaces the need for any key policy.
3. Context is ignored during decryption and cannot detect mismatches.
4. Encryption context is authenticated additional data, not a secret, and can appear in audit records.