A caller workflow grants its GITHUB_TOKEN contents: read. A nested reusable workflow tries to grant itself contents: write. What should the platform team expect?

1. The nested workflow cannot elevate the token permission above what the caller chain permits.
2. Adding secrets: inherit automatically grants contents: write.
3. The contents scope is ignored whenever a reusable workflow is used.
4. The innermost workflow always determines all token rights for every caller.