A regulated team enables content exclusion for sensitive files. A third-party MCP server has independent filesystem access. Which statement about the resulting protection is correct?

1. Content exclusion is a guardrail for supported Copilot tools; separate permissions are still needed to restrict the MCP server's file access.
2. All indirect access to the files is impossible after the exclusion rule is saved.
3. The server becomes read-only for every repository as soon as any file is excluded.
4. The exclusion rule automatically rewrites the MCP server's operating-system permissions.