A user has Contributor access to a resource group. The organization also requires every new storage account to use an approved configuration. Which statement correctly distinguishes the two controls?

1. RBAC governs permitted actions; Azure Policy governs allowed resource configurations
2. RBAC automatically enforces every storage configuration rule
3. Azure Policy assigns every user an Azure role
4. Contributor access bypasses every assigned policy