A user belongs to a group with Reader at subscription scope and directly has Contributor on one resource group. What access does the user normally have in that resource group, assuming no deny assignments?

1. Contributor permissions in that resource group
2. No access because the role names differ
3. Reader only because it is assigned higher in the hierarchy
4. Owner throughout the subscription