An identity can manage a Key Vault resource but cannot retrieve secrets through its data API. Which distinction matters?

1. Resource management permissions and secret data permissions are separate
2. Secret names alone determine access rights
3. All management roles automatically read every secret
4. A resource lock grants missing read permission